Skip to content
BeryX
Security and Trust

Security · Responsible disclosure

Found a vulnerability? Tell us.

We are grateful to everyone who helps us protect BeryX and our customers' data. This page explains how to report, what you may test and what we promise in return.

Last reviewed: 7 October 2026

How to report

  1. Send an email to the security contact with a description, steps to reproduce and the impact you observed.
  2. If you can, include the URL or endpoint, the test account you used and when you tested. Do not send other people's data.
  3. Give us time to fix it before you disclose publicly. We agree the disclosure date with you.
Send a report

seguranca@praxis.lbostuff.tech · security.txt

What we promise

Maximum times, counted from when we receive your report.

Acknowledgement
3 business days
First assessment
5 business days
Fix for a critical
7 days
Fix for a high
30 days
Fix for a medium
90 days

Scope

In scope

  • The BeryX app and its API
  • This website and its forms
  • The MCP server and API tokens

Out of scope

  • Denial of service, load testing and spam
  • Social engineering and physical access
  • Our providers' own systems (Google Cloud, Anthropic, etc.)
  • Automated scanner output without demonstrated impact

Rules

  • Report vulnerabilities by email to the security contact. We acknowledge receipt within 3 business days and send a first assessment within 5; the target fix time follows our vulnerability policy (7, 30 and 90 days for critical, high and medium).
  • Test only against your own account and workspace. Do not access third-party data, do not run load or denial-of-service tests and do not use social engineering.
  • We do not run a paid bug bounty. We credit reporters publicly after the fix, if they wish.

Safe harbour

If you act in good faith and within these rules, we will not take legal action against you or ask others to. If you come across someone else's data by accident, stop, do not keep it and tell us.

External penetration test

We have not had an external penetration test yet. The scope, test accounts and rules are prepared; the provider is not yet contracted. It is planned before the SOC 2 Type I audit and yearly after that; the summary will be published here.