Telivy Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

- This program is open to all ethical security researchers 18 years of age or older.
- You must agree to our program terms of service, which prohibit illegal activity, social engineering, and denial-of-service attacks.

Reporting Process:

Please submit all bug reports through this platform
Alternatively, you can email us at: [email protected]
Your report should be clear, concise, and include the following information:
- A brief summary of the vulnerability
- Detailed steps to reproduce the vulnerability
- Proof of concept (e.g., screenshots, code snippets) if possible
- An explanation of the potential impact of the vulnerability
- Your assessment of the vulnerability severity based on our guidelines (link guidelines)

Testing Requirements:

- restriction to use vulnerability scanners
- Focus on portal.telivy.com only
- Please do not test during off hours (Weekends and after 5 pm)
- please do not perform social engineering attacks
- We are particularly interested in vulnerabilities that could lead to:
Unauthorized access to user data or systems
System compromise or takeover
Breaches of confidentiality, integrity, or availability
- We appreciate responsible disclosure practices. Please do not exploit vulnerabilities for personal gain or publicly disclose them before we have had a reasonable opportunity to fix them (typically 60 days).

Possible Awards:

- Recommendations for any future opportunities
- Telivy swag if available
- We reserve the right to exclude certain vulnerabilities from reward consideration, such as low-risk findings or those easily discoverable through automated tools.
- Opportunity to consult for Telivy

We aim to acknowledge all submitted reports within [number] business days. We will keep you informed of the bug fixing process and estimated timelines for resolution. Once a vulnerability is verified and fixed, bounty payouts, if any will be processed within 30 business days.

Special Notes:

- The discovered vulnerabilities should not be disclosed elsewhere to be available for any credit or awards.