Brave Software believes that working with security researchers across the globe is crucial in making the web safer. If you believe you've found a security issue in our product or service, we encourage you to notify us. We will do our best to work with you to resolve the issue promptly. Thanks in advance!

? Recent Changes

This section summarizes notable recent changes. It's only a summary, though — the full policy is below the changelog.

• ℹ️ On May 17 2021, we added details about Brave Search

• ℹ️ On April 23 2021, we added details about BAT fraud issues that are in-scope.

• ℹ️ On March 2 2021, we added details about in-scope network connections.

• ℹ️ On Jan 29 2020, we added Brave Android Beta to in scope.

• ℹ️ On Oct 29 2019, we clarified exclusions for DoS bugs.

• ℹ️ On August 21 2019, we noted that social media account takeovers on our websites are out of scope.

• ℹ️ On March 15 2019, we noted that non-default extensions are out of scope.

• ℹ️ On March 8 2019, we noted that Github wikis being publicly editable is out of scope.

• ℹ️ On February 25 2019, we removed the PGP key ID for encrypting reports since it had expired.

• ℹ️ On February 5 2019, we noted that issues in Chromium are generally out of scope and should be reported to (and fixed by) the Chromium team, not the Brave team.

• ℹ️ On January 11 2019, we noted that unexpected outbound network connections are always in-scope.

? Bounty Schedule

This is approximately how much we expect to pay for reports. Understand that this is a guide — it's meant to help set expectations.

• "not applicable" — Reports about things that we have specifically noted as out of scope.

• "informative" — We're aware of this, or we don't really see it as a security issue.

• $50 — [Special] This is a public security issue (like a CVE) for another browser or platform — but it also works on Brave and we should fix it in Brave. [See scope section for details.]

• ≤$100 — While this bug is appropriately categorized as a security issue, it doesn't present much risk and isn't a priority to fix.

• ≤$250 — A minor security problem. Someone should probably fix it. It's likely not getting fixed in the next release.

• ≤$500 — This is definitely a real problem that puts Brave users at risk. We will ship a fix in a scheduled release. Hacker swag available upon request.

• ≤$1000 and beyond — A really bad problem. We're probably going to ship a fix for this before our next scheduled release. We hope we don't have many of these problems — but if we do, we really want to hear about them.

Most of the bounties we award are $50-$300. Few of them are more than $500.

?‍? Disclosure Policy

• Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.

• Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party. We may publicly disclose the issue before resolving it, if appropriate.

• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.

• If you would like to send us an encrypted report, email security@brave.com with a request for us to set up a PGP key. We will reply with the PGP long key ID and post it in our hackerone page.

• We are generally happy to publicly disclose reports two weeks after shipping the release which contains the fix.

ℹ️ Program notes

• The output of an analysis tool doesn't constitute a report on its own. Please submit a PoC or describe in detail the specific attack which you've identified.

• We prefer it when hackers file one report per bug, no matter how many different ways that underlying issue can be exploited. This makes it easier for us to understand what you're reporting and track our progress in fixing the issue. If fixing the problem described in one report would also prevent the troubling behavior described in another report of yours, those issues should probably be combined.

• We are a relatively small team with a relatively large project to protect. Please bear with us if it takes a few days for us to validate and triage your report. Sometimes reports get lost in the shuffle, and we need a reminder. The best way to do this is to comment on your report and mention the Brave team member(s) you were working with. If this doesn't get our immediate attention, we are probably all putting out a fire, but you can also email <security@brave.com>. We would prefer that you not personally message Brave team members on other platforms or channels.

• To our discretion, we may decide to grant the highest between the Impact and the Severity for constructive and detailed reports/vulnerability cases.

✅ In-scope

• Security/privacy issues in any current release of the Brave browser (with occasional exclusions). This includes the Chromium-based desktop browser, and the current iOS and Android releases. Packages are available at https://brave.com/downloads.html.

• Security/privacy issues in https://github.com/brave-experiments/sta-rs, especially cryptography bugs.

• Network connections from the Brave browser that may compromise user privacy. This includes but is not limited to: requests to Brave Rewards endpoints for users who have NOT opted into Rewards, connections to third-party services (like Google) in the background and not in response to a user action, requests that leak IP or browsing activity from Tor windows, and DNS requests that do not use the DNS-over-HTTPS setting on platforms that fully support DoH. This does NOT include requests initiated by websites not owned by Brave, or requests that we deem necessary for Brave to function properly.

• Security or privacy issues in any repo owned by https://github.com/brave-intl or https://github.com/brave (not forked) that is NOT deprecated or archived.

• Information about BAT fraud that is not already known to us. We are particularly interested in knowing how fraudulent users can bypass our payout antifraud checks, such as specific IP rotation services or VM types.

• Security issues affecting high-impact web services like https://search.brave.com, https://talk.brave.com, https://creators.basicattentiontoken.org/, and https://subscriptions.bsg.brave.com.

• Security issues affecting any of the following Ethereum addresses: 0x0d8775f648430679a709e98d2b0cb6250d2887ef, 0x44fcfabfbe32024a01b778c025d70498382cced0, 0x7c31560552170ce96c4a7b018e93cddc19dc61b6, 0xfbfa258b9028c7d4fc52ce28031469214d10daeb, 0x67fa2c06c9c6d4332f330e14a66bdf1873ef3d2b

• Medium or high severity security issues for other browsers which also affect Brave (as long as we don't already know about them). Public issues are only eligible for our $50 notification tier, rather than by severity. Chromium/Firefox security issues are only eligible for this tier if we fix them in Brave directly rather than waiting for the upstream Chromium/Firefox fix.

❌ Exclusions

The following products are out of scope:

• All LinkBubble products

• The legacy Muon-based version of Brave

• The Muon desktop framework

• Our legacy iOS codebase

• Jira helpdesk which isn't ours

Issues in Chromium/Firefox are only eligible for this program if we plan to fix them directly in Brave. For most Chromium security issues, we wait for the issue to be fixed in Chromium and inherit the fix from them — these issues are out of scope. The same goes for iOS with Firefox, which is what iOS Brave is based on.

⭕️ The following bug classes are out-of scope:

• Bugs that are already reported on any of Brave's issue trackers (https://github.com/brave, https://github.com/brave-intl), or that we already know about. Note that some of our issue trackers are private.

• Bugs on community.brave.com or forum.batcommunity.org should be reported to Discourse, not Brave: https://hackerone.com/discourse. Bugs on support.brave.com should be reported to Zendesk: https://hackerone.com/zendesk. Bugs on store.brave.com should be reported to https://www.originprotocol.com/, though we can help escalate if they do not respond.

• Bugs on websites that are not owned or operated by Brave.

• Issues in an upstream software dependency (ex: Chromium or Firefox) which are not severe enough to warrant a fix independently of upstream. If the upstream maintainer believes the issue is wontfix but we disagree, we may reward for the issue and consider it valid.

• Login/logout CSRF

• Attacks requiring physical/local access to a user's device.

• New browser fingerprinting or cross-site tracking methods are generally out-of-scope but will be considered on a case-by-case basis.

• Attacks that allow a website to detect whether a user is using Brave instead of Chrome. This is impossible to defend fully against, and we are already aware of ways this can be done.

• Attacks that allow a website to detect whether a user is using or has used a Tor or Private Browsing window.

• Self-XSS

• Issues related to software or protocols not under Brave's control

• Vulnerabilities in outdated versions of Brave

• Redirect continuation URL vulnerabilities

• Missing security best practices that do not directly lead to a vulnerability

• Issues that have little to no impact on the general public

• Issues in LinkBubble (https://play.google.com/store/apps/details?id=com.linkbubble.playstore) are no longer in scope.

• Pairs of Unicode and Latin characters which look similar-enough to be used in homoglyph-based phishing.

• Denial-of-service and crash issues in our client-side products are out-of-scope UNLESS: the issue does not exist in Chrome AND the issue crashes/hangs the entire browser (not just a single tab). In addition, unless the DOS issue also leads to remote code execution or disclosure of users' data, we will not award a bounty but may give you thanks. In general, we do not consider resource exhaustion attacks to be security bugs.

• Denial-of-service and crash issues on our services will be considered on a case-by-case basis but usually are out-of-scope unless serious.

• A Github wiki being publicly editable is out of scope. Even though this poses a reputation risk, we already know about this issue and are continually working on fixing it.

• Bugs in browser extensions which are not enabled/installed by default in Brave.

• Social media account takeovers on our websites, unless the account is an official one owned by Brave (as opposed to an employee account or a community-maintained account)

• DLL hijacking unless it doesn't require attacker to modify the PATH variable or do other actions that require local access.

• Email flooding attacks

• Server metrics being exposed on /metrics endpoints

• Reports of scam sites in Brave Search result listings. Please report these to search-abuse@brave.com instead.

• Repos containing NPM package names that are unclaimed on the public NPM registry, unless you find examples of code that try to install them from the public NPM registry.

• Path being displayed in 404 pages

• Documents with public commenting/suggesting/reading permission that don't contain any private info

• Reports without clear steps that allow us to reproduce the vulnerability

• Reports about npm/pip/etc. dependency vulnerabilities will be considered on a case-by-case basis. We may not award for these unless there is a proof of concept.

• We will try our best to consider reports which are not in English but may not be able to triage them due to lack of non-English speakers.

While researching, we'd like to ask you to refrain from:

• Denial of service

• Spamming

• Social engineering (including phishing) of Brave Software staff or contractors

• Any physical attempts against Brave Software property or data centers

Thank you for helping keep Brave Software and our users safe!