LiveAgent Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

Most up to date terms and conditions of our bug bounty program can be found at https://www.liveagent.com/bug-bounty-program/

Share the details of any suspected vulnerabilities with the LiveAgent Development Team at [email protected]. Please do not publicly disclose these details outside of this process without explicit permission. If you want to submit multiple reports at once, please submit only one report (the most important if possible) and wait for a response.

You may only test against a LiveAgent hosted application Account for which you are the Account Owner or an Agent authorized by the Account Owner to conduct such testing.
For example:
*yourdomain*.ladesk.com
We will reward you for the following types of vulnerabilities:

Remote Command Execution (RCE)
SQL Injection
Broken Authentication
Broken Session Management
Access Control Bypass
Cross-Site Scripting (XSS)
Cross-Site Request Forgery (CSRF)
Open URL Redirection
Directory Traversal

Reports of when an attacker can only threaten his own account with Admin role only will not be rewarded with a bounty. XSS caused by an Admin will not be rewarded with a bounty.

Testing Requirements:

In reporting any suspected vulnerabilities, please include as much information as possible. Make sure to always include detailed steps to reproduce the found vulnerability in text form, supported by screenshots and/or video.

Possible Awards:

The standard bounty reward is $50 per bounty concerning LiveAgent web application submitted and verified by our development team.
We will only reward the first reporter of a vulnerability. Duplicate reports will not be rewarded.
Vulnerabilites on our webpage www.liveagent.com are not in the scope of our bug bounty program and will NOT be financially rewarded.

Special Notes:

In order to qualify, the vulnerability must exist in the latest public release (including officially released public betas) of the LiveAgent software. Only security vulnerabilities will qualify. We would love it if people reported other bugs via the appropriate channels, but since the purpose of this program is to fix security vulnerabilities, only bugs that lead to security vulnerabilities will be eligible for rewards. Other bugs will be accepted at our discretion.

We prefer communication by email at [email protected]

Other Submissions Handling