Responsible Disclosure Policy

This policy is designed for:

• Ethical security researchers and penetration testers not engaged under contract with LIVA Telecom
• Cybersecurity professionals
• Customers or users who discover vulnerabilities*
• Technical partners or vendors

If you belong to any of these groups and believe you've discovered a security issue, we want to hear from you.

Responsible security research may be conducted on LIVA Telecom systems, products, and services that are:

• Internet-accessible and public facing
• Within your authorised access level (for example, customer or user portal access)

If you are unsure whether something is in scope, please contact us.

When conducting research, please:

• Avoid denial-of-service attacks or anything that degrades service
• Act in good faith and avoid causing harm or disruption
• Report vulnerabilities to us as soon as reasonably possible
• Only test systems you are authorised to access
• Never access, modify, store, or exfiltrate customer data or LIVA Telecom intellectual property
• Do not use social engineering, phishing, or physical security attacks
• Do not test third-party systems, applications, or services
• Avoid privacy violations and do not destroy or corrupt data

Please do not report vulnerabilities that cannot be directly exploited or do not pose a risk. Examples include:

• • Weak or misconfigured SSL/TLS certificates
• • Misconfigured DNS records (SPF, DKIM, DMARC)
• • Missing HTTP security headers
• • Theoretical CSRF or cross-site framing attacks
• • Automated scan results without manual verification
• • Vulnerabilities without a working exploit
• • MITM or physical access-based attacks
• • Issues requiring excessive user interaction
• • Content spoofing without HTML/CSS impact
• • CSRF on non-sensitive pages
• • Public files with no sensitive content
• • Non-sensitive cookie flags
• • Vulnerable libraries with no exploit path
• • Issues affecting outdated browsers
• • Static resources in public buckets
• • Verbose error messages or software version disclosures
• • Rate limiting issues on non-auth endpoints
• • Open redirects without security impact
• • CSV injection without an exploit

If you find a security issue, please submit it via our contact us web form, providing as much detail as possible, including:

• Description of the vulnerability
• Affected URLs, services, or assets
• Steps to reproduce the issue
• Proof-of-concept code or screenshots
• Test accounts or objects used
• Your contact details (optional)

We appreciate your efforts and aim to protect researchers acting in good faith. We will not take legal action if you follow this policy, stop testing once a vulnerability is confirmed, and cooperate with us on coordinated disclosure.