Security policy

1. What this policy covers

Brah is an app for your computer and this website. Brah keeps your settings and your keys on your computer, and sends your screen and questions only to the AI service you choose. This website sells licences through Stripe and checks licence keys. If you find a security weakness in Brah, the website or the licence system, we want to hear about it.

2. How to report a weakness

Email brah@ferrolo.com with "Security" in the subject line. Do not open a public issue on GitHub. Include:

• what the problem is and where it is (the Brah version, the page or the address on this website);
• the steps to reproduce it;
• what an attacker could do with it.

Send only the personal data you need to show the problem. If you saw data that belongs to someone else, describe it rather than send it.

3. What we do when you report

• We reply within 3 working days to confirm we have your report.
• We keep you informed while we look into it and fix it.
• We tell you when the fix is out.
• If you want, we credit you by name when we talk about the fix.

4. Safe harbour for good-faith research

If you act in good faith and follow the rules below, we consider your research authorised. We will not take legal action against you or report you to the police under the Computer Misuse Act 1990 or any other law, and we will not treat your research as a breach of our terms. If someone else takes action against you for research done under this policy, we will make it known that you had our authorisation.

5. Rules for research

• Test only with your own copy of Brah, your own trial and your own licence key.
• Do not make payments with cards that are not yours, and do not test the checkout with real payments you plan to dispute.
• Stop when you reach data that is not yours. Do not copy, keep, change, delete or share it, and tell us at once.
• Do not disrupt the service. No denial-of-service attacks, and no automated requests at a volume that slows this website or the licence check for other people.
• Do not contact, trick or phish our customers or us.
• Give us 90 days to fix the problem before you tell anyone else about it, unless we agree a different date with you.
• Do not ask for payment in exchange for the details of a problem.

6. When safe harbour does not apply

Safe harbour is for people who help us protect our users. It does not apply if you:

• access, keep, change or delete data that belongs to someone else, beyond what you need to show the problem;
• disrupt the service, or make it slower or unavailable for other people;
• demand money, or threaten to publish a problem or data unless you are paid;
• publish a problem or any data before we fix it;
• break any of the rules above on purpose.

In those cases we keep the logs as evidence, report the matter to Action Fraud and the police, and take criminal and civil action against you. We do not pay ransoms.

7. Out of scope

These do not qualify, unless you show a real effect on the security of our users:

• problems in the AI services you connect to Brah, such as OpenAI, Anthropic, Groq, Deepgram or ElevenLabs, or in your own Hermes server or local model. Report those to the company or project that runs them;
• problems in services we use, such as Stripe, Apple, GitHub, Cloudflare or Vercel. Report those to the company that runs the service;
• getting round the trial or the licence check on your own computer by changing the app. A check on a computer you control can always be changed;
• what an AI service says or does when you ask it to act on your screen. Brah asks you before risky actions in Auto mode, and you choose what you allow;
• reports from automated scanners with no proof that the problem can be exploited;
• missing security headers or email settings (SPF, DKIM, DMARC) with no attack that uses them;
• attacks that need someone to paste code into their own browser or terminal, or a computer with its security turned off.

8. Rewards

We do not run a bug bounty and we do not pay for reports. We credit reporters who want to be credited.

9. Machine-readable contact

Our contact details for security reports are also at /.well-known/security.txt, in the format that RFC 9116 sets out.