Security

This page explains how to report a security vulnerability in the services of Brilliant Design Ltd. (“Brilliant,” “we,” or “us”), and what you can expect from us when you do. We welcome reports from researchers, customers, and anyone else who finds a weakness in what we build.

Table of contents

• 1. How to report
• 2. What happens next
• 3. Fix and disclosure
• 4. Scope
• 5. If you report
• 6. No bug bounty

1. How to report

Email legal@brilliant.design, our security contact. Please include, as far as you can:

• a description of the vulnerability and its potential impact;
• the affected service, URL, app version, or plugin version;
• the steps needed to reproduce it, with any proof of concept;
• how we can reach you for follow-up questions.

Please do not include more personal data of other people than the report needs. A machine-readable copy of this contact is published at /.well-known/security.txt.

2. What happens next

We will acknowledge your report within two (2) business days. We will then investigate, tell you whether we can confirm the issue, and keep you informed of our progress until it is resolved. We may ask you for more detail along the way.

3. Fix and disclosure

We fix confirmed vulnerabilities as quickly as their severity requires. Once a fix is in place, we disclose the issue, and where a vulnerability has affected our users or their data, we notify those affected as the law and our commitments require, including the breach notice in Section 10 of our Data Processing Addendum. We ask that you give us a reasonable time to fix an issue before you disclose it publicly, and that you agree the timing of any publication with us. With your permission, we will credit you when we disclose.

4. Scope

This policy covers:

• brilliant.design;
• api.brilliant.design;
• rooms.brilliant.design;
• the Brilliant desktop app;
• the Brilliant Figma plugin.

Services run by third parties, including those listed on our Subprocessors page, are outside its scope; please report issues in them to the provider concerned. Denial-of-service testing and social engineering of our team or our users are also out of scope.

5. If you report

We ask that you:

• test only against accounts and data you own, or have permission to use;
• do not access, change, or delete other people's data beyond the minimum needed to show the issue, and stop and report as soon as you reach it;
• do not degrade or interrupt the service for others;
• keep the issue confidential until we have fixed it.

6. No bug bounty

Brilliant does not run a bug bounty program and does not pay for reports. We are grateful for every report all the same.

Last updated: October 19, 2026