LiveAgent aims to keep its service safe for everyone, and data security is of utmost importance. Our Vulnerability Disclosure Program is intended to minimize the impact any security flaws have on our tools or their users. LiveAgent’s Vulnerability Disclosure Program covers software partially or primarily written by Quality Unit.
If you are a security researcher and have discovered a security vulnerability in the Service, we appreciate your help in disclosing it to us privately and giving us an opportunity to fix it before publishing technical details.
LiveAgent will engage with security researchers when vulnerabilities are reported to us as described here. We will validate, respond, and fix vulnerabilities in support of our commitment to security and privacy. We won’t take legal action against, suspend, or terminate access to the Service of those who discover and report security vulnerabilities responsibly. LiveAgent reserves all of its legal rights in the event of any noncompliance.
Share the details of any suspected vulnerabilities with the LiveAgent Development Team at firstname.lastname@example.org. Please do not publicly disclose these details outside of this process without explicit permission. In reporting any suspected vulnerabilities, please include as much information as possible. If you want to submit multiple reports at once, please submit only one report (the most important if possible) and wait for a response.
We are pleased to offer a bounty for vulnerability information that helps us protect our customers as a thanks to the security researchers who choose to participate in our bug bounty program. The regular bounty reward is $50 per vulnerability submitted and verified by our development team.
We will only reward the first reporter of a vulnerability. Duplicate reports will not be rewarded.
You may only test against a LiveAgent Account for which you are the Account Owner or an Agent authorized by the Account Owner to conduct such testing. For example:
We will reward you for the following types of vulnerabilities:
Reports of when an attacker can only threaten his own account with Admin role only will not be rewarded with a bounty. XSS caused by an Admin will not be rewarded with a bounty.
In order to qualify, the vulnerability must exist in the latest public release (including officially released public betas) of the software. Only security vulnerabilities will qualify. We would love it if people reported other bugs via the appropriate channels, but since the purpose of this program is to fix security vulnerabilities, only bugs that lead to security vulnerabilities will be eligible for rewards. Other bugs will be accepted at our discretion.
Please adhere to the following guidelines in order to be eligible for rewards under this disclosure program:
In addition, please allow us at least 90 days to fix the vulnerability before publicly discussing or blogging about it. Our team believes that security researchers have right to report their research and that disclosure is highly beneficial, and understands that it is a highly subjective question of when and how to hold back details to mitigate the risk that vulnerability information will be misused. If you believe that earlier disclosure is necessary, please let us know so that we can begin a conversation.
We publicly inform about all fixed security issues through our change log. Issues related to security are marked by tag [Security].
We appreciate your recent sign up for a LiveAgent.
A message will be sent to your email address containing login details, right after your account is installed.
If you wait for a while, after installation is complete you will be able to access your account directly from here.
After the process is over, we will send the login details to your mailbox.