1. Security contact
Iskander Al-Sarayfi, Founder and Managing Director (sócio-administrador) of BRAIALS LTDA. (CNPJ 69.137.980/0001-75), is responsible for the security of all Braials systems.
Email: security@braials.com (subject: "Security report"). If that address does not work for you, use info@braials.com.
Machine-readable contact details: /.well-known/security.txt.
2. Systems covered
- braials.com (website, student and teacher platform, API)
- The Braials learning app (web app and Android app com.braials.app)
Third-party services we use (for example Cloudflare, payment providers or Preply) are not covered. Please report issues in those services to the provider.
3. How we protect Braials
- All traffic uses HTTPS, with HSTS (preloaded) and a Content Security Policy.
- Web traffic reaches our servers only through Cloudflare. Server administration is possible only with SSH keys (password login is disabled), and repeated failed logins are blocked automatically.
- Passwords are stored as bcrypt hashes. Every account can turn on two-factor authentication (TOTP). Logins are rate-limited and account actions are protected against cross-site request forgery.
- An automated test suite, including security tests, runs before every release. A release is rolled back automatically if its health checks fail.
- The database is backed up every hour, with off-site copies. No backup is kept longer than 90 days. How we handle personal data is described in our privacy policy.
4. Reporting a vulnerability
- Describe the issue, the affected URL or component, and the steps to reproduce it.
- We aim to confirm receipt within 5 working days and keep you informed until the issue is fixed.
- Please give us reasonable time to fix the issue before sharing it publicly.
- Reports in English, Dutch or Portuguese are welcome.
5. Guidelines
- Only use your own accounts. Do not access, change or delete data of other users.
- No denial-of-service testing, spam, social engineering or physical attacks.
- Stop and report as soon as you have shown that an issue exists.
We will not take legal action against good-faith research that follows these guidelines. We do not currently run a paid bug bounty.
6. Version history
- 1.1 (3 November 2026): added section 3, a dedicated address [email protected], and narrowed the systems covered to Braials.
- 1.0 (7 October 2026): first version.