Security vulnerability disclosure
Tell us privately, before anyone else.
We welcome reports from security researchers and users. If you believe you have found a security vulnerability in LiveContext, please tell us privately so we can fix it before anyone can exploit it.
Compliance
SOC 2 Type II in progress
Our SOC 2 Type II audit is under way.
ISO 27001 in progress
ISO 27001 certification is under way.
GDPR compliant
Your personal data is processed under the GDPR. Privacy requests go through the contact page.
How to report
Email [email protected] or use the security category of the contact form. Please include a description of the issue, the steps to reproduce it, the affected URL or component, and the impact you observed. Do not open a public issue. You can write in English or French.
What we commit to
We acknowledge your report within 5 business days.
We keep you informed while we investigate and fix the issue, and tell you when it is resolved.
If you wish, we credit you in the release notes once the fix ships.
Rules for good-faith research
- Test only against accounts and data you own or are explicitly allowed to use.
- Do not access, modify or delete data that belongs to other users. If you reach someone else's data by accident, stop and mention it in your report.
- Do not run denial-of-service tests, send spam, or scan at a volume that degrades the service for other users.
- Do not use social engineering, phishing or physical attacks against our team, our users or our premises.
- Give us a reasonable time to fix the issue before any public disclosure, and agree the timing with us.
Good-faith research
If you follow these rules and act in good faith, we will consider your research authorized and will not take legal action against you for it.
Scope
In scope: livecontext.ai and its subdomains, and the source code of LiveContext Community Edition.
Out of scope: vulnerabilities in third-party services we use (please report them to their vendor), and findings without a demonstrated security impact, such as a missing best-practice header on its own.
We do not run a paid bug bounty program at this time.
This policy is also referenced from our machine-readable security.txt file.