BRM-loading · layering pigment…
BRM-loading · layering pigment…
Legal · responsible disclosure · security researcher safe-harbour
BRMSTE LTD publishes a responsible-disclosure policy that surpasses the NCSC Vulnerability Disclosure Toolkit and the ISO/IEC 29147 + 30111 international standards. Good-faith researchers operating within the published scope receive substrate-side safe-harbour from action under the Computer Misuse Act 1990 · the Computer Fraud and Abuse Act · and equivalent statutes globally.
v1.2026.05.16 · contact security@shravanbansal.com · block 946,772
Safe-harbour · four binding clauses
In scope
brmste.ai · all routes
Including /legal/*, /register/*, /api, /honest-ai, the offering hubs, the domain pages, and the museum surface.
api.brmste.ai
Production API surface · X-Honest-AI header v6 · X-Patent-Anchor header · OAuth 2.1 DCR flow.
mcp.brmste.ai/mcp
BRM-MCP v2 Streamable HTTP endpoint · 66 tools · OAuth 2.1 + bearer-token.
re-tyre.com
Re-Tyre subsidiary surface · same master-frame discipline.
Out of scope
Operator-pack personal email + iCloudDrive
Founder personal infrastructure · social-engineering attempts on the operator are out of scope and may be prosecuted.
Third-party services BRMSTE consumes
Cloudflare · Bitcoin mainnet · OpenTimestamps calendars · GitHub · npm registry · OS package mirrors. Report to the upstream vendor.
Physical-security attacks
Tailgating · social engineering of any party · physical compromise or loss of operator hardware. Report to the police.
Denial-of-service testing without prior written authorisation
DoS / DDoS / load-testing is out of scope absent a signed test agreement; coordinated load-tests can be arranged.
Email security@shravanbansal.com (preferred) with the subject prefix [SECURITY-DISCLOSURE]. Include: clear description of the finding · steps to reproduce · scope assessment · suggested remediation if you have one · whether you want public credit. PGP key available on request.
Founder-reviewed admission posture applies. A human reads the report and replies with a triage decision (in scope · out of scope · need-more-info) within five working days, or BRMSTE explicitly waives the engagement.
Default ninety-day private window from triage. Earlier disclosure on agreement; later disclosure for issues requiring infrastructure changes. The substrate emits a class=incident StageRecord on remediation; the public-facing disclosure goes to /register/incidents within seventy-two hours of remediation deployment.
Researcher name (or pseudonym) published at /register/incidents under the remediated finding, unless researcher requests private acknowledgement. The chain anchors the disclosure-event SHA-256.
“If you find a flaw and tell us in good faith, you are safe with us. We will read your report within five working days; we will not sue you; we will credit you (or keep you private) when the finding lands at the public register.”
Responsible disclosure · v1.2026.05.16 · safe-harbour binding by publication