Brevo Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://www.brevo.com/legal/responsible-disclosure/
description: >-
  Brevo publishes a Responsible Disclosure Policy as a legal page, linked from the footer of
  every www.brevo.com page. It names a dedicated intake address, states the disclosure rules
  and the evidence a submission must carry. It is NOT exposed as an RFC 9116 security.txt —
  /.well-known/security.txt returns a Next.js 500 error page on www.brevo.com and 404 on
  api.brevo.com and developers.brevo.com — so a machine looking for the standard discovery
  path finds nothing. There is no public bug bounty program (no HackerOne, Bugcrowd or
  Intigriti listing found).
policy:
- https://www.brevo.com/legal/responsible-disclosure/
contact:
- disclosure@brevo.com
bug_bounty:
  program: null
  platform: null
  note: No public bounty platform listing found.
security_txt:
  published: false
  probed:
  - {url: 'https://www.brevo.com/.well-known/security.txt', status: 500}
  - {url: 'https://api.brevo.com/.well-known/security.txt', status: 404}
  - {url: 'https://developers.brevo.com/.well-known/security.txt', status: 404}
  - {url: 'https://www.brevo.com/security.txt', status: 404}
  note: >-
    A one-line security.txt pointing at the existing policy page would close the machine
    discoverability gap at zero cost. Recorded as a concrete, provider-fixable finding.
policy_terms:
  preferred_channel: email to disclosure@brevo.com
  rules:
  - Respect the law and do not break it
  - Do not DDoS or otherwise disrupt, interrupt or degrade the services
  - Do not use social engineering against clients or staff
  - Do not conduct spam or phishing attacks
  - Do not put Brevo or its clients' data at risk
  - Do not permanently alter or delete data
  submission_requirements:
  - Clear description and evidence of the vulnerability (logs, screenshots, responses)
  - Detailed steps to reproduce
  - Relevant platforms, operating systems and versions
  - Relevant IP addresses or URLs
  - Supporting evidence (logging, tracing)
  - Assessment of exploitability or impact
  - Reporter contact details
  language: English preferred
evidence:
- {source: 'https://www.brevo.com/legal/responsible-disclosure/', kind: disclosure-page, http_status: 200, keywords: [responsible disclosure, vulnerabilities, security team, disclosure policy]}
- {source: 'https://www.brevo.com/features/data-security/', kind: footer-link, http_status: 200, note: Responsible Disclosure link present in the global footer}
x-evidence:
  fetched: '2026-08-13'