Braiins Systems s.r.o.
Vulnerability disclosure program on security.txt braiins.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 9
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 5 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Response
-
Within 5 days
The commitment: a reply within 5 business days.
- Safe harbor
-
Partial
We will not bring civil action against you for that research or for reporting it to us, and we will not file a criminal complaint about it.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
9 assets you may test, 7 excluded.
Domains 1
- braiins.com
Wildcard domains 1
- *.braiins.com
Products and areas 7
- Braiins Manager and its backend
- Braiins OS firmware, all supported device families and build targets, including the update and signing mechanism, the management interface and the on-device APIs.
- Braiins Pool
- Braiins Toolbox
- Farm Monitor
- Farm Proxy
- Hashpower
Out of scope (7)
- Phishing, social engineering, physical intrusion
- Products and services we do not operate, including third-party pools, hardware we did not manufacture, and firmware forks not published by us
- the systems, facilities and accounts of our customers
- third-party components inside our products
- Third-party platforms we use but do not operate
- Volumetric denial of service and stress testing against our websites, APIs or stratum endpoints
- Websites, apps, social accounts, downloads and pool endpoints that imitate Braiins or use our name without being operated by us
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Braiins Systems s.r.o.'s policy. "We" in these lines means the program, not this site.
While testing
-
Act in good faith and avoid harm to us, our products and systems, our users and third parties.
-
Use exploitation only as far as needed to confirm the issue exists. Do not pivot, do not persist, do not access or modify data that is not yours.
-
Test against your own devices and your own accounts. If you need something to test against, ask us first.
-
Do not degrade our services, and do not run anything that affects other users' mining.
-
If you come across personal data, stop, tell us, and do not retain a copy.
-
Do not publicly disclose the fact or the content of your report before disclosure has been agreed under this policy.
-
Do not make your report, or your silence about it, conditional on a payment or any other benefit.
-
Keep to applicable law, including sanctions and export control rules, and tell us if you are researching on someone else’s behalf.
Not accepted
-
Output of automated scanners without a working proof of concept
-
missing HTTP security headers
-
weak TLS configuration
-
outdated dependencies
-
Clickjacking and tabnabbing with no security consequence
-
self-XSS
-
issues requiring a browser or platform that is out of support
-
SPF, DKIM and DMARC observations without demonstrated impact
-
Issues that require the attacker to already hold administrative credentials
-
that require the operator to have deliberately disabled a protection
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 3 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.