# Brix Signage — vulnerability disclosure (RFC 9116)
#
# If you have found a security problem in Brix, tell us. We will reply, keep
# you informed until it is fixed, and credit you if you want us to. We will not
# pursue you for research that respects the scope below.

Contact: mailto:hello@brixsignage.com
Contact: https://brixsignage.com/security/#report
Expires: 2027-09-29T00:00:00.000Z
Preferred-Languages: en
Canonical: https://brixsignage.com/.well-known/security.txt
Policy: https://brixsignage.com/security/#report

# In scope: brixsignage.com, cms.brixsignage.com, app.brixsignage.com,
# api.brixsignage.com (including the MCP endpoint and its OAuth sign-in),
# play.brixsignage.com, and the Brix player applications.
#
# Please do not: run denial-of-service tests, send bulk or automated traffic,
# access or modify another customer's data, or test physical screens you do not
# own. If a proof of concept needs a workspace, ask us and we will give you one.