Last updated: 21 October 2026.
If you think you have found a security vulnerability in liveplanner, thank you. Please tell us privately so we can fix it before anyone else finds it. This page explains how to report it, what is in scope, and how to test without putting anyone else's data at risk.
How to report
Email it to us privately:
Only the liveplanner team reads that mailbox. We keep the conversation about the issue, its fix and any eventual disclosure in that email thread.
Please do not report a vulnerability publicly, such as on social media or in a forum. A report sent through the contact form is not ignored, but we will ask you to continue by email.
This page is also what liveplanner.app/security and our /.well-known/security.txt file point to.
A good report includes:
- what is affected (a URL, an API endpoint, or a screen in the app);
- the steps to reproduce it;
- what an attacker could do with it;
- any proof-of-concept code or screenshots.
What is in scope
- The hosted service at liveplanner.app and the liveplanner subdomains we run, including
mcp.liveplanner.app. - The liveplanner command line,
@liveplanner/clion npm.
What is out of scope
- Third-party services we rely on, such as Cloudflare (hosting) and Resend (email). Please report those to the vendor.
- Reports from automated scanners with no demonstrated impact.
- Missing security headers or best-practice settings with no working exploit.
- Rate limits that only slow an attacker down.
- Self-XSS, and clickjacking on pages with no state-changing action.
- Anything that relies on a share link you were given. A share link is a key by design: anyone who holds it can open the plan (see Share Link Security).
- Social engineering of anyone.
Rules for testing
When you look for vulnerabilities, please:
- use only accounts and plans you own, or that you have explicit permission to test;
- stop as soon as you reach someone else's data, keep only what proves the issue, and do not keep, share or change it;
- not run denial-of-service, load or volume tests, or anything that degrades the service for other people;
- not send spam or phishing, or try to trick our users or anyone else;
- give us a reasonable time to fix the issue before you disclose it publicly, and agree the disclosure with us.
Safe harbour
If you follow these rules in good faith, we consider your research authorised. We will not take legal action against you or report you to law enforcement for it. If someone else takes action against you over research that followed these rules, we will make it known that it was authorised. If you are unsure whether something is allowed, ask us by email before you try it.
What to expect from us
liveplanner is free and has no paid tier, so we cannot promise response times and we do not offer a bug bounty. We do promise to:
- read every report and handle it in good faith;
- keep your report confidential while we work on it;
- keep you updated by email;
- ship a fix before any details are published;
- credit you when we publish details of the fix, unless you would rather we didn't.
Was this article helpful?