Responsible disclosure

At LIVEOP, the security of our systems and data is of the highest importance. Despite the care and security measures we take, a vulnerability may still exist in our systems. If you discover one, we ask you to report it to us following the guidelines below.

What we ask of you

If you discover a vulnerability:

• Report it as soon as possible to security@liveop.net.
• Give us enough information to reproduce and verify the problem.
• Handle your knowledge of the vulnerability responsibly: do not share it with others.
• Do not abuse the vulnerability, for example by going further than strictly necessary to demonstrate the problem.
• Do not take any action that leads to theft or deletion of data, changes to data or system settings, or disruption of our services.

What you can expect from us

When you report a vulnerability:

• We treat your report confidentially.
• We are grateful for your report and appreciate your help.
• We respond within five working days with a confirmation of receipt and an indication of our next steps.
• We keep you informed of our progress and of any solution.
• We take no legal action against you if you follow these guidelines.
• If you wish, we credit you by name as thanks on our website or through other channels.

Out of scope

The following findings are in principle outside the scope of responsible disclosure:

• Brute-force attacks or social engineering.
• Denial-of-service attacks or disruption testing.
• Vulnerabilities in outdated browsers or plugins.
• Reports without enough information to reproduce the problem.
• Findings from automated scans without an impact analysis.

Legal disclaimer

This policy does not indemnify actions that go beyond responsible reporting. LIVEOP reserves the right to report misuse to the relevant authorities in cases of intentional damage, theft or abuse.

Contact

Send your report to security@liveop.net. Thank you for helping us keep LIVEOP secure.