BRACEMONT · TOLARON S.R.O.
Security, with clear boundaries.
How Bracemont is being built, who is responsible, and how to report a concern.
Updated 24 October 2026
Who operates Bracemont
Bracemont is a venture of Tolaron s.r.o., Prague, Czech Republic. Initial engagements will be operated by the founder. The platform is in development and is not currently open for self-service scanning.
What is working today
The local development platform includes founder passkey access, versioned scopes, scope approvals, isolated offline fixture runs, audit records and approval before evidence export. It has not had an independent security review.
Executable security scanners, fix pull requests, deployed re-testing and the hosted client service are still in development. The public product preview uses synthetic data. It does not show a client assessment.
How testing will be authorized
Before any client test, we will agree the targets, methods, time window, exclusions, credentials, limits and stop procedure in writing. The initial scope is source code and staging. Production is excluded by default.
Our design keeps four human approvals: scope authorization, the exact plan for risky tests, merging a fix, and sharing reports or publishing content. Registering interest or reporting a vulnerability does not authorize a test.
Client data and providers
The hosting, model providers and processing locations for client assessments are not finalized. Before receiving access, we will agree what data may be processed, by whom, where and for how long, including any AI use.
The public website’s signup and email handling is described separately in the Privacy notice. We do not currently make an EU-only hosting or zero-retention claim for the future assessment service.
Report a vulnerability in Bracemont
Email security@bracemont.com with the affected Bracemont URL or component, a concise description, the potential impact and the minimum redacted detail needed to understand it. English and Czech reports are welcome.
Please leave passwords, access tokens and other people’s personal data out of your first email. If sensitive material is needed, ask us to agree a transfer method first. We will review the report and coordinate next steps with you.
This reporting channel does not grant permission to run tests. Ask us to agree a scope before active testing. Do not disrupt services, access other people’s data, use social engineering or test third-party systems. There is no standing bug-bounty reward commitment.
Report scanning abuse or get help
If you believe activity associated with Bracemont is affecting your system, send the time and timezone, affected target and any safe identifying details to abuse@bracemont.com. These reports reach our security contact.
For product questions, use support@bracemont.com. These are founder-operated channels, not a 24-hour incident-response service.