Scope, limitations & privacy

Not a penetration test

Bronkode does not perform penetration testing or active exploitation. Assessments are advisory reviews that help you apply security best practices and identify code-level vulnerabilities. They are not attack simulations. We do not attempt to break into, overload or otherwise interfere with your systems.

Snapshot in time

Every assessment reflects the codebase, configuration and documentation as they existed on the review date. Changes made after the review are not covered. A Re-check within 60 days of a review confirms whether earlier findings have been fixed.

New vulnerabilities are discovered every day in open-source libraries, frameworks and AI models, and in the hosting platforms and third-party services an application depends on. An assessment reflects what was publicly known on the review date, so it cannot guarantee that no vulnerabilities exist, or that none will be discovered later. Keeping dependencies up to date and automated security alerts switched on reduces this risk.

Advisory, not a guarantee

Assessments reduce risk. They do not eliminate it or guarantee security, availability or fitness for any purpose. Findings and recommendations are professional opinions based on the information and access provided. Decisions about whether and how to act on them remain yours.

Fix prompts and AI rules files

Fix prompts, rules files (such as AGENTS.md, CLAUDE.md, Cursor rules and .github/copilot-instructions.md) and CI configurations are provided as guidance for you and your AI tools. You choose whether to use them, you run them, and you should review every change your AI tool makes before it reaches production. Bronkode does not make changes to your code and is not responsible for changes made by you, your developers or your AI tools. Rules files make repeat issues less likely but cannot guarantee that AI tools will follow them.

Confidentiality

We treat all code, documentation, credentials and business information you share as confidential. We use it only to perform the assessment you engaged us for, request read-only access wherever possible, and don't share findings with anyone other than you or people you authorise. We're happy to sign a mutual non-disclosure agreement (NDA) before any access is granted. For due diligence engagements, this can include the target company.

Privacy notice

Bronkode Software Solution Services (Pty) Ltd is the responsible party for personal information collected through this website, and processes it in line with the Protection of Personal Information Act, 2013 (POPIA).

What we collect

• Details you submit through our forms: name, email address, company and the contents of your message.
• Basic technical information your browser sends when you visit (such as IP address and browser type), as recorded by our hosting provider.

Why we collect it

• To respond to your enquiry and provide services you request.
• To send you the checklist you asked for and, occasionally, related insights. Every email includes a way to unsubscribe.

Sharing & storage

We don't sell your personal information. We share it only with service providers who help us operate (for example our hosting provider Cloudflare, which stores checklist signups, and email services), and only as needed for these purposes. Some of these providers may store data outside South Africa, in which case we rely on providers that offer adequate protection as required by POPIA.

Your rights

You may ask to access, correct or delete your personal information, or object to its processing, by emailing hello@bronkode.co.za. You also have the right to lodge a complaint with the Information Regulator of South Africa.

Cookies

This site doesn't use tracking or advertising cookies. Your light or dark theme preference is stored in your own browser only. Our signup forms use Cloudflare Turnstile to block automated spam; it checks your browser for signs of a bot and may set a strictly necessary cookie for that purpose. It is not used for advertising.

Last updated: October 2026.