Security at BreachVex

Responsible Disclosure

If you find a security issue in BreachVex or in our infrastructure, we want to hear about it.

• Scope: the breachvex.com domain, our public APIs, the BreachVex worker, and any first-party subdomain.
• Safe harbor: we won't take legal action against researchers working in good faith. That rules out DoS, data exfiltration beyond what's needed to prove impact, and social engineering of our staff.
• Reporting: send a clear writeup with reproduction steps to security@breachvex.com.
• Encrypted reports: ask for our preferred encrypted channel in your first email and we'll reply out of band.
• SLA: acknowledgement within 48 calendar hours. Triage and remediation target of 30 days for high/critical issues.
• Coordinated disclosure: we agree the public disclosure date with the reporter, on a case-by-case basis.

Out of scope

• Denial-of-service or DDoS attacks against our infrastructure.
• Social engineering of staff, contractors, or customers.
• Vulnerabilities in third-party services we depend on (please report to the upstream vendor).

Data Handling

• Workers are ephemeral: each scan runs real, industry-standard offensive tooling in a fresh, isolated container built for that one scan and destroyed when it ends.
• Credentials encryption: AES-256-GCM on the credentials you supply for authenticated scans, with a server-side key you never hold. TLS 1.3 in transit.
• EU-hosted data: customer scan data is stored and processed in the EU. A few website-layer processors run outside the EEA under Standard Contractual Clauses; the full list is in our Privacy Policy.
• Evidence capture: proving an access-control flaw means showing the data it exposes, so a finding can carry a response excerpt capped at 3,000 characters. We keep those excerpts to demonstrate impact, and for nothing else.
• We keep worker logs for 90 days, for debugging. Scan reports follow your retention settings.
• GDPR: privacy by design from day one. DPA available on request.

Infrastructure

Our production architecture:

• Sandboxed execution: workers run in isolated containers with restricted capabilities and no access to the host filesystem.
• Network isolation: each scan runs in its own network namespace, with no cross-tenant traffic.
• Workers keep no persistent customer data; state lives in our encrypted database, not on the fleet.

Authorization & Scope

Customers must sign an authorization statement before any scan starts. We turn down assets that don't come with explicit written scope. Running a pentest without authorization is illegal in most jurisdictions, and we won't be part of it.

Hall of Fame

Researchers who report valid issues are credited here, if they agree to it. No reports received yet.