Security at Brua

How to report a vulnerability in Brua, and what we do with the report.

Reporting a vulnerability

If you find a security problem in Brua, the back office, the edge, the SDKs, the command line or the Figma plugin, write to security@brua.dev. Tell us what you found, how to reproduce it and what it reaches. We'd rather hear about a false alarm than miss a real one.

We acknowledge a report within two working days, keep you informed while we work on it, and fix confirmed problems before anything is said about them in public. We ask that you give us that time, don't access or change data that isn't yours, and don't run tests that degrade the service for others. We don't take legal action against researchers who follow these terms.

The same contact and terms are published at /.well-known/security.txt (RFC 9116).

How the service is run

Brua is run by Meginhufr AS, Norway. The platform runs on AWS in Stockholm and on Cloudflare, with files stored in the European Union; both providers hold their own certifications (SOC 2, ISO 27001 and others), which cover the infrastructure. Brua itself holds no certification yet.

Access to the back office is by email and password with every link sent by email working once; systems use API keys scoped to what they do, stored hashed; uploads go straight to storage through short-lived signed addresses; and nothing reaches an app before an approver has merged it. Plugins and integrations talk only to Brua's own hostnames.

Data

What the website collects and keeps is on the privacy page. Customers' assets and the people who sign in are covered by the early-access terms.