Brave Software

Brave Software believes that working with security researchers across the globe is crucial in making the web safer. If you believe you've found a security issue in our product or service, we encourage you to notify us. We will do our best to work with you to resolve the issue promptly. Thanks in advance!

NOTE: If an issue is out of scope, we will do our best to explain why in 1-2 messages. We may not reply to follow-ups due to limited resources. Please refrain from spamming us or repeating points that have been previously been addressed.

📅 Recent Changes

This section summarizes notable recent changes. It's only a summary, though — the full policy is below the changelog.

• ℹ️ On November 26 2025, we added a section on LLM and AI Agent Security.
• ℹ️ On January 19 2025, we added some out-of-scope items and noted that reporting these may damage your reputation.
• ℹ️ On May 7 2024, we added policy details for AI safety.
• ℹ️ On March 5 2023, we marked https://github.com/brave/brave-ios out of scope because iOS code is now in https://github.com/brave/brave-core.
• ℹ️ On May 17 2021, we added details about Brave Search
• ℹ️ On April 23 2021, we added details about BAT fraud issues that are in-scope.
• ℹ️ On March 2 2021, we added details about in-scope network connections.
• ℹ️ On Jan 29 2020, we added Brave Android Beta to in scope.
• ℹ️ On Oct 29 2019, we clarified exclusions for DoS bugs.
• ℹ️ On August 21 2019, we noted that social media account takeovers on our websites are out of scope.
• ℹ️ On March 15 2019, we noted that non-default extensions are out of scope.
• ℹ️ On March 8 2019, we noted that Github wikis being publicly editable is out of scope.
• ℹ️ On February 25 2019, we removed the PGP key ID for encrypting reports since it had expired.
• ℹ️ On February 5 2019, we noted that issues in Chromium are generally out of scope and should be reported to (and fixed by) the Chromium team, not the Brave team.
• ℹ️ On January 11 2019, we noted that unexpected outbound network connections are always in-scope.

👁‍🗨 Disclosure Policy

• Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
• Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party. We may publicly disclose the issue before resolving it, if appropriate.
• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
• If you would like to send us an encrypted report, email [email protected] with a request for us to set up a PGP key. We will reply with the PGP long key ID and post it in our hackerone page.
• We do not issue CVEs except for severe issues with wide public impact. Reports will be disclosed at our discretion.

ℹ️ Program notes

• The output of an analysis tool doesn't constitute a report on its own. Please submit a PoC or describe in detail the specific attack which you've identified.
• We prefer it when hackers file one report per bug, no matter how many different ways that underlying issue can be exploited. This makes it easier for us to understand what you're reporting and track our progress in fixing the issue. If fixing the problem described in one report would also prevent the troubling behavior described in another report of yours, those issues should probably be combined.
• We are a relatively small team with a relatively large project to protect. Please bear with us if it takes a few days for us to validate and triage your report. We would prefer that you not personally message Brave team members on other platforms or channels.
• To our discretion, we may decide to grant the highest between the Impact and the Severity for constructive and detailed reports/vulnerability cases. We generallly rate bugs based on how urgent it is for Brave to fix rather than following CVSS strictly.

✅ In-scope (except for exclusions below)

• Security/privacy issues in any current release of the Brave browser (with occasional exclusions). This includes the desktop, iOS and Android releases. You can see current release numbers at https://brave.com/latest/. Older releases are not in scope.
• Network connections from the Brave browser that may compromise user privacy. This includes but is not limited to: requests to Brave Rewards endpoints for users who have NOT opted into Rewards, connections to third-party services (like Google) in the background and not in response to a user action, requests that leak IP and browsing activity from Tor windows (see below for exclusions), and DNS requests that do not use the DNS-over-HTTPS setting on platforms that fully support DoH. This does NOT include requests initiated by websites not owned by Brave, or requests that we deem necessary for Brave to function properly.
• Security or privacy issues in any repo owned by https://github.com/brave-intl or https://github.com/brave (not forked) that is NOT deprecated or archived.
• Security issues affecting high-impact web services like https://search.brave.com, https://api-dashboard.search.brave.com/, https://account.brave.com/, https://talk.brave.com, https://creators.basicattentiontoken.org/, and https://subscriptions.bsg.brave.com. In general we care about security issues affecting these domains and their subdomains: brave.com, basicattentiontoken.org, bravesoftware.com, brave.software, brave.io. However some pages may be out of scope if they are run by a third party or have no real security impact.
• Security issues affecting any of the following Ethereum addresses: 0x0d8775f648430679a709e98d2b0cb6250d2887ef, 0x44fcfabfbe32024a01b778c025d70498382cced0, 0x7c31560552170ce96c4a7b018e93cddc19dc61b6, 0xfbfa258b9028c7d4fc52ce28031469214d10daeb, 0x67fa2c06c9c6d4332f330e14a66bdf1873ef3d2b. However issues affecting the BAT contract are out of scope unless there is concrete proof that funds can be stolen using it.
• Issues which exist upstream in Chromium are only eligible for a bounty if we fix them in Brave directly rather than waiting for the upstream Chromium fix. (This is very rare.)

LLM and AI Agent Security

Scope and Approach

Only LLM vulnerabilities with direct, verifiable security impact are in scope for this bug bounty program. Content generation issues, jailbreaks, and hallucinations without concrete security consequences should be reported to [email protected].

Prompt Injection Vulnerabilities

To qualify as a valid security issue, prompt injection attacks must demonstrate:

1. Direct and Verifiable Security Impact - The vulnerability must result in one or more of the following:

   • Data leakage (unauthorized access to sensitive information)
   • Data destruction or modification
   • Other unauthorized actions performed on behalf of the user that have clear security impact

2. Unintended Behavior - The attack must cause the LLM/agent to deviate from the user's intended instructions without explicit user direction.

Out of Scope:

• Jailbreaks, safety bypasses, or getting the model to generate harmful content
• Model hallucinations or pretending to execute actions without actual impact
• Prompt injections where the user explicitly instructs the AI to follow potentially malicious content (e.g., "follow instructions on this web page" where the page contains injection attempts)
• Prompt injections where the model-generated output has no direct security impact (e.g., when the model generates a textual response influenced by untrusted content, or produces tool calls that have no security impact)
• Attacks requiring the user to directly paste or input malicious prompts themselves
• System prompt leakage
• Theoretical vulnerabilities without demonstrated, verifiable security impact

❌ Exclusions

The following products are out of scope:

• All LinkBubble products
• The legacy Muon-based version of Brave
• The Muon desktop framework
• Jira helpdesk which isn't ours
• NEAR verifier

Issues in Chromium are only eligible for this program if we plan to fix them directly in Brave. For most Chromium security issues, we wait for the issue to be fixed in Chromium and inherit the fix from them — these issues are out of scope.

The following bug classes are out-of scope:

• Bugs that are already reported on any of Brave's issue trackers (https://github.com/brave, https://github.com/brave-intl), or that we already know about. Note that some of our issue trackers are private.
• Bugs on hosts that are run by other companies. community.brave.com should be reported to Discourse, not Brave: https://hackerone.com/discourse. Bugs on support.brave.com should be reported to Zendesk: https://hackerone.com/zendesk. Bugs on survey-admin.brave.com should be reported to https://blocksurvey.io/, though we can help escalate if they do not respond. Bugs on status.brave.com should be reported to [email protected].
• Bugs on websites that are not owned or operated by Brave.
• Issues in an upstream software dependency (ex: Chromium) which are not severe enough to warrant a fix independently of upstream. This will be decided at our discretion. If the upstream maintainer believes the issue is wontfix but we disagree, we may reward for the issue and consider it valid.
• Login/logout CSRF
• Attacks requiring physical/local access to a user's device or existing account compromise of any kind.
• New browser fingerprinting or cross-site tracking methods are generally out-of-scope but will be considered on a case-by-case basis. Note that Tor windows in Brave generally do NOT have additional fingerprinting protection other than for the user's IP address, as our goals are substantially weaker than Tor Browser's.
• Attacks that allow a website to detect whether a user is using Brave instead of Chrome. This is impossible to defend fully against, and we are already aware of ways this can be done.
• Attacks that allow a website to detect whether a user is using or has used a Tor or Private Browsing window; or requests which originate from a Tor window using the user's real IP but do NOT reveal anything about which sites the user is visiting.
• Self-XSS
• Issues related to software or protocols not under Brave's control
• Vulnerabilities in outdated versions of Brave
• Redirect continuation URL vulnerabilities
• Missing security best practices that do not directly lead to a vulnerability
• Issues that have little to no impact on the general public
• Issues in LinkBubble (https://play.google.com/store/apps/details?id=com.linkbubble.playstore) are no longer in scope.
• Pairs of Unicode and Latin characters which look similar-enough to be used in homoglyph-based phishing.
• Denial-of-service and crash issues in our client-side products are usually out-of-scope unless the DOS issue also leads to remote code execution or disclosure of users' data. In general, we do not consider resource exhaustion attacks to be security bugs.
• Denial-of-service and crash issues on our services will be considered on a case-by-case basis but usually are out-of-scope unless serious.
• A Github wiki being publicly editable is out of scope. Even though this poses a reputation risk, we already know about this issue and are continually working on fixing it.
• Bugs in browser extensions which are not enabled/installed by default in Brave.
• Links and social media account takeovers, unless the link is an official one owned by Brave (as opposed to an employee account or a community-maintained account)
• Impersonation attacks where the true account information is visible
• Account takeovers that have little to no impact, such as emails listed in package.json files.
• DLL hijacking unless it doesn't require attacker to modify the PATH variable or do other actions that require local access.
• Email flooding attacks
• Server metrics being exposed on /metrics endpoints
• Reports of scam sites in Brave Search result listings. Please report these to [email protected] instead.
• Repos containing NPM package names that are unclaimed on the public NPM registry, unless you find examples of code that try to install them from the public NPM registry.
• Path being displayed in 404 pages
• Documents with public commenting/suggesting/reading permission that don't contain any private info
• Reports without clear steps that allow us to reproduce the vulnerability
• Reports about npm/pip/etc. dependency vulnerabilities will be considered on a case-by-case basis. We may not award for these unless there is a proof of concept.
• Reflected/self-XSS, including entering javascript: in the URL bar (this is generally needed for bookmarklets functionality)
• Hostname confusion due to '@' symbol in a URL.
• Network requests that don't go through Brave Shields or HTTPS Upgrades which are not in a webpage context will be considered on a case-by-case basis depending on impact.
• Reports involving the scanning of QR codes to open URLs directly in a browser, without any accompanying exploit or vulnerability, are considered out of scope
• Attacks which require unusual Brave or system configurations (such as blocking network requests to Brave services, installing a malicious filter list, or disabling recommended security features) are generally out-of-scope
• Account takeovers (S3 buckets, NPM packages, etc.) where there is no proof the account was ever owned by Brave.
• VPN or other premium account access that persists beyond the trial period or otherwise bypasses payment
• Email clients automatically creating hyperlinks from text
• The download/upload file dialog not showing the origin in some cases
• brave://downloads showing a different origin from Chrome. As of https://github.com/brave/brave-browser/issues/43501, Brave shows the file download source origin while Chrome shows the referring origin.
• Spoofing the displayed URL in brave://downloads is out of scope, as this is a known issue inherited from Chromium and the real URL is visible on hover.
• In general, reporting of .brave TLDs should be submitted directly to https://unstoppabledomains.com/abuse. In limited circumstances where an exploit is able to impact a Brave product or service will we consider them in scope.
• Spoofing URLs, domains, or other security info is out of scope if it's clear that the info is truncated (ex: with ...)
• Leaked credentials on Brave domains are out of scope, unless the leak is due to a security issue in an in-scope Brave product.
• We will try our best to consider reports which are not in English but may not be able to triage them due to lack of non-English speakers.
• Transaction parsing and warnings displayed in Brave Wallet which would typically be covered by a transaction simulation service.
• Browser lock bypasses on iOS as this feature will be deprecated soon. Browser lock bypasses on other platforms will be considered at our discretion.
• Reports which rely on input manipulation without showing that an unprivileged attacker can manipulate the input.
• We reserve the right to close issues which lack an end-to-end proof of concept showing that the attack is feasible.
• IDOR related attacks which do not directly show how the UUID is being stolen in the proof of concept
• Bypasses that grant Brave Origin access without payment are generally out of scope
• Issues where the browser treats a domain with a trailing dot as different from the bare domain, as these are generally intentional

While researching, we'd like to ask you to refrain from:

• Denial of service
• Spamming
• AI generated reports without validating them yourself
• Social engineering (including phishing) of Brave Software staff or contractors
• Any physical attempts against Brave Software property or data centers

AI Generated Reports and Spam

As of January 2025, due to an increased volume of low-quality reports, we may at our discretion close reports as "Not Applicable" or "Spam" if they are:

1. covered by an exclusion above;
2. cannot be reproduced using the steps defined in the report in a production environment;
3. do not concisely define how to reproduce the report;
4. do not have anything to do with Brave;
5. appears to be AI generated without human validation (is overly verbose such as greater than 300 words for the report and citing specific lines of code and/or contains bogus claims, even if some claims are valid).

We reserve the right to ban you from our program after 2 reports closed as N/A or Spam. If you cannot produce a reproducible proof of concept, please file an issue or open a pull request instead.

Simply asking an AI to identify a bug report in Brave is unlikely to yield a valid report. Before submitting a report generated by AI please ensure you have done enough human work to validate that any issue is (a) in scope, and (b) reachable by constructing a POC, generating an ASAN trace, recording the bug reproducing, or performing your own debugging. Therefore, we also may at our discretion consider these reports spam and close them so please make sure you're authoring high quality reports if relying on AI.

Thank you for helping keep Brave Software and our users safe!