Is brave.com safe to use as a vendor?

brave.com scored 92/100 on LynxRadar's security posture assessment. The domain meets baseline security requirements. 13 checks passed, 2 warnings, 0 critical issues across 16 passive checks including TLS, DMARC, security headers, breaches, and CVEs.

What TLS version does brave.com use?

brave.com uses TLSv1.3 with TLS_AES_128_GCM_SHA256. TLSv1.3 negotiated with TLS_AES_128_GCM_SHA256 (128-bit). Strong configuration with no deprecated protocols or weak ciphers detected.

Does brave.com have DMARC configured?

Yes. brave.com's DMARC policy is set to 'reject'. SPF record: yes. Strengths: DMARC policy set to reject (strongest); DMARC pct=100 — policy applies to all mail; Aggregate reports (rua) configured; Forensic reports (ruf) configured; SPF hard-fail (-all) configured; SPF DNS lookup count: 5/10 (within limit); DKIM configured (selectors: google, s1, s2, zendesk1, zendesk2).

Does brave.com have SPF configured?

Yes. SPF record found: v=spf1 include:_spf.google.com include:mail.zendesk.com include:mg-spf.greenhous...

Does brave.com have security headers configured?

brave.com has 4 of 5 recommended security headers. Present: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy. Missing: Permissions-Policy.

Does brave.com use HSTS?

Yes. HSTS enabled: max-age=31536000s (365 days) with includeSubDomains and preload. Meets best-practice configuration.

Has brave.com been involved in a data breach?

No known breaches found. No known breaches found in public disclosure databases.

Does brave.com have known CVE vulnerabilities?

Detected technologies: AmazonS3, Proxy/CDN, Hugo/0.119.0. (Proxy/CDN detected but excluded from CVE matching — upstream infrastructure). No high or critical CVEs found for detected versions.

Is brave.com's SSL certificate valid?

Yes. Strengths: Certificate valid, 137 days remaining; Issued by Amazon.

brave.com Security Report — Grade A- (92/100)

Q: Does brave.com have DNSSEC enabled?

No. Strengths: 2 nameservers configured (kim.ns.cloudflare.com, chip.ns.cloudflare.com); SOA record present and MNAME consistent with NS set; 5 MX record(s) present; DNSSEC enabled: zone signed (DNSKEY present) and chain of trust intact (DS record in parent zone); Zone transfers properly restricted on all nameservers; Address records present: 4 A record(s), 8 AAAA record(s). Issues: All nameservers are from a single provider (cloudflare.com) — a provider outage takes down the domain.

A-

Trust rating

Excellent · 92/100

Procurement snapshot

No critical findings. The 2 remaining items are configuration gaps, not architectural problems.

Strengths

MX Records & Mail Provider

DNS CAA Records

HSTS Header

TLS Protocol Support

Questions to ask

Confirm DNSSEC rollout timeline

Estimated remediation effort: 2–5 hours

Based on a passive external scan — supplement with vendor-provided attestations, not a replacement.

Trust Score Trend

→ No change 1 scan · Last scanned October 20, 2026

Score

100 75 50 25 0

A-

brave.com

92/100

Compliance & Certifications

Not yet verified

SOC 2 Type II

Audit report not on file

3rd party · AICPA

ISO 27001

Certificate not on file

3rd party · accredited body

GDPR

DPA not on file

Self-reported

CCPA

Self-reported

Incident History

No public breaches on record

Security Posture

2 items need attention

13 passed

Add a backup DNS provider

DNS Configuration

2–4 hours Medium

A single provider outage would make this domain fully unreachable, with no fallback. Every nameserver for brave.com is run by a single company (cloudflare.com). If that company has an outage, your entire domain becomes unreachable for everyone until they recover — nothing you do can route around it in the meantime. Spreading across two providers removes that single point of failure.

NIST 800-53CP-8

Telecommunications services redundancy

How to fix this

1Sign up with a second DNS provider (if you're on cloudflare.com, a different one like Route53, Cloudflare, or NS1 works).

2Copy your existing DNS records over to the new provider so both are in sync.

3Add the new provider's nameservers to your domain registrar's nameserver list, alongside the existing ones (don't remove the originals until both are confirmed working).

4Confirm it worked: search "dns lookup" and enter brave.com — you should see nameservers from both providers.

Report unlocked.

View all 13 passed checks

MX Records & Mail Provider

DNS CAA Records

HSTS Header

TLS Protocol Support

MTA-STS & TLS Reporting

TLS Configuration

DMARC / Email Security

Cookie Security

security.txt (RFC 9116)

Known Breaches

Subprocessors & Tech Stack

CVE Exposure

Certificate Hygiene

Couldn't check: Malware / Phishing Blocklist — the check didn't complete (the site blocked or timed out our scanner, or a data source was unavailable), so this isn't counted in the score.

Company Signals

Operational risk

Last funding

Employees

Trust Resources

Claim profile →

Trust Center

Not detected

Security contact (security.txt)

brave.com/.well-known/security.txt

DPA (Data Processing Agreement)

Subprocessors List

Similar companies

Appears in

Vendors graded A

389 companies · LynxRadar ranking

Top 10% by security score

297 companies · LynxRadar ranking

Medium Priority

Not enabled

Strengths: 2 nameservers configured (kim.ns.cloudflare.com, chip.ns.cloudflare.com); SOA record present and MNAME consistent with NS set; 5 MX record(s) present; DNSSEC enabled: zone signed (DNSKEY present) and chain of trust intact (DS record in parent zone); Zone transfers properly restricted on all nameservers; Address records present: 4 A record(s), 8 AAAA record(s). Issues: All nameservers are from a single provider (cloudflare.com) — a provider outage takes down the domain.

Likelihood: ★★☆☆☆

Impact: ★★★☆☆

Best Practice

4/5 present

Missing: Permissions-Policy

Likelihood: ★★☆☆☆

Impact: ★☆☆☆☆