Vulnerability Program

Reporting a vulnerability

The LiquidPixels Vulnerability Reporting Program Terms and Conditions (“Terms”) cover your participation in the LiquidPixels Vulnerability Reporting Program (the “Program”). These Terms are between you and LiquidPixels (“LiquidPixels,” “us,” or “we”). By submitting any vulnerabilities to LiquidPixels or otherwise participating in the Program in any manner, you accept these Terms.

IF YOU DO NOT AGREE TO THESE TERMS BELOW, PLEASE DO NOT SEND US ANY SUBMISSIONS OR OTHERWISE PARTICIPATE IN THIS PROGRAM. THE SUBMISSION PROCESS MUST BE FOLLOWED IN ITS ENTIRETY IN ORDER FOR US TO VALIDATE ANY SUBMISSION. WE WILL RESPOND TO SUBMISSIONS ONLY AS NECESSARY. INCOMPLETE SUBMISSIONS, OR OTHER CORRESPONDENCE, WILL NOT RECEIVE A RESPONSE FROM US.

Program Overview

The Program enables users to submit vulnerabilities and exploitation techniques (“Vulnerabilities”) to LiquidPixels about eligible LiquidPixels products and services (“Products”) for a chance to earn rewards in an amount determined by LiquidPixels in its sole discretion (“Bounty”). Each Product for which Bounties are available has a separate set of terms applicable to that Product (the “Product Program Terms”), which are incorporated by reference into these Terms. In the event of a conflict between these Terms and the Product Program Terms for a particular Product, the Product Program Terms control for that particular Product only. The decisions made by LiquidPixels regarding Bounties are final and binding. LiquidPixels may change or cancel this Program at any time, for any reason.

Changes to These Terms

We may change these Terms at any time. Participating in the Program after the changes become effective means you agree to the new Terms. If you do not agree to the new Terms, you must not participate in the Program.

If you wish to opt-out of the Program and not be considered for Bounties, contact us at security@liquidpixels.com. Opting out will not affect any licenses granted to LiquidPixels in any Submissions provided by you.

Program Eligibility

You ARE eligible to participate in the Program if you meet all of the following criteria:

You are 14 years of age or older. If you are at least 14 years old but are considered a minor in your place of residence, you must obtain your parent’s or legal guardian’s permission prior to participating in this Program; and
You are either an individual researcher participating in your own individual capacity, or you work for an organization that permits you to participate. You are responsible for reviewing your employer’s rules for participating in this Program.

LiquidPixels seeks to ensure that by offering Bounties under this Program, it does not create any violation of the letter or spirit of a participant’s applicable gifts and ethics rules and will award all Bounties within any applicable gifts/ethics policy.

You ARE NOT eligible to participate in the Program if you meet any of the following criteria:

You are a resident of any countries under U.S. sanctions or any other country that does not allow participation in this type of program;
You are under the age of 14;
Your organization does not allow you to participate in these types of programs;
You are a public sector employee (government, education, or otherwise) and have not obtained permission from your ethics compliance officer to participate in the Program;
You are currently an employee of LiquidPixels, or an immediate family (parent, sibling, spouse, or child) or household member of such an employee;
Within the six months prior to providing us your Submission you were an employee of LiquidPixels;
You currently (or within six months prior providing to us your Submission) perform services for LiquidPixels in an external staff capacity that requires access to the LiquidPixels Corporate Network, such as agency temporary worker, vendor employee, business guest, or contractor; or
You are or were involved in any part of the development, administration, and/or execution of this Program.

It is your responsibility to comply with any polices that your employer may have that would affect your eligibility to participate in the Program. If you are participating in violation of your employer’s policies, you may be disqualified from participating or receiving any Bounty. All payments will be made in compliance with local laws, regulations, and ethics rules. LiquidPixels disclaims any and all liability or responsibility for disputes arising between an employee and their employer related to this matter.

There may be additional restrictions on your ability to enter depending upon your local law.

Submission Process and Coordinated Vulnerability Disclosure

If you believe you have identified a Vulnerability that meets the applicable requirements set forth in the Product Program Terms, you may submit it to LiquidPixels in accordance with the following process:

Each Vulnerability submitted to LiquidPixels shall be a “Submission.” Submissions must be sent encrypted with the LiquidPixels GPG key to security@liquidpixels.com. In the initial email, specify the Vulnerability details, and also include as much of the following information as possible:

Type of issue (buffer overflow, SQL injection, cross-site scripting, etc.);
Product and version that contains the bug, or URL if for an online service;
Any special configuration or data required to reproduce the issue;
Step-by-step instructions to reproduce the issue;
Proof-of-concept or exploit code; and/or
Impact of the issue, including how an attacker could exploit the issue.

Depending on the detail of your Submission, LiquidPixels may award a Bounty of varying scale. Well-written reports and functional exploits are more likely to result in Bounties. Submissions that do not meet the requirements described above are considered incomplete, will not receive a response from us, and are not eligible for Bounties. If a Submission is rejected, you may resubmit a Submission one (1) additional time.

LiquidPixels is not responsible for Submissions that we do not receive for any reason. If you do not receive a confirmation email after making your Submission, notify LiquidPixels at security@liquidpixels.com to ensure your Submission was received.

Beyond the confirmation email, you will not receive any updates from us. You may hear from us if we validate your Submission and are to be awarded a Bounty.

There are no restrictions on the number of qualified Submissions you can provide and for which you may be paid a Bounty.

If you submit a Vulnerability for a product or service that is not covered by the Program at the time you submitted it, you will not be eligible to receive Bounty payments if the product or service is later added to the Program.

Submission License

LiquidPixels is not claiming any ownership rights to your Submission. However, by providing any Submission to LiquidPixels, you:

Grant LiquidPixels the following non-exclusive, irrevocable, perpetual, royalty free, worldwide, sub-licensable license to the intellectual property in your Submission:
- (i) To use, review, assess, test, and otherwise analyze your Submission;
- (ii) To reproduce, modify, distribute, display and perform publicly, and commercialize, and create derivative works of your Submission and all its content, in whole or in part; and
- (iii) To feature your Submission and all of its content in connection with the marketing, sale, or promotion of this Program or other programs (including internal and external sales meetings, conference presentations, trade shows, and screen shots of the Submission in press releases) in all media (now known or later developed);
Agree to sign any documentation that may be required for us or our designees to confirm the rights you granted above;
Understand and acknowledge that LiquidPixels may have developed or commissioned materials similar or identical to your Submission, and you waive any claims you may have resulting from any similarities to your Submission;
Understand that you are not guaranteed any compensation or credit for use of your Submission; and
Represent and warrant that your Submission is your own work, that you have not used information owned by another person or entity, and that you have the legal right to provide the Submission to LiquidPixels.

Confidentiality of Submissions Restrictions on Disclosure

Protecting clients is LiquidPixels highest priority. We endeavor to address each Vulnerability report in a timely manner. While we are doing that, we require that Bounty Submissions remain confidential and cannot be disclosed to third parties or as part of paper reviews or conference submissions. You can make available high-level descriptions of your research and non-reversible demonstrations after the Vulnerability is fixed. We require that detailed proof-of-concept exploit code and details that would make attacks easier on clients be withheld for 30 days after the Vulnerability is fixed. LiquidPixels will notify you when the Vulnerability in your Submission is fixed. You may be paid prior to the fix being released and payment should not be taken as notification of fix completion. VIOLATIONS OF THIS SECTION COULD REQUIRE YOU TO RETURN ANY BOUNTIES PAID FOR THAT VULNERABILITY AND DISQUALIFY YOU FROM PARTICIPATING IN THE PROGRAM IN THE FUTURE.

Submission Review Process

After a Submission is sent to LiquidPixels in accordance with the Submission Process, LiquidPixels engineers will review the Submission and validate its eligibility. The review time will vary depending on the complexity and completeness of your Submission, as well as on the number of Submissions we receive. You will not receive updates throughout the validation process.

LiquidPixels retains sole discretion in determining which Submissions are qualified, according to the rules set forth in the Product Program Terms. If we receive multiple bug reports for the same issue from different parties, the Bounty will be granted to the first eligible Submission. If a duplicate report provides new information that was previously unknown to LiquidPixels, we may award a differential to the person submitting the duplicate report.

Bounty Payments

The decisions made by LiquidPixels regarding Bounties are final and binding.

If we have determined that your Submission is eligible for a Bounty under the applicable Product Program Terms, we will notify you of the Bounty amount and provide you with the necessary process to process your payment. You may waive the payment if you do not wish to receive a Bounty.

If there is a dispute as to who the qualified submitter is, we will consider the eligible submitter to be the authorized account holder of the email address used to enter the Program.

Before receiving a Bounty, you are required to complete and submit an Internal Revenue Service tax form (e.g., Form W-9, W-8BEN, 8233) within 30 calendar days of notification of validation. If you do not complete the required forms as instructed or do not return the required forms within the time period listed on the notification message, we may not provide payment. We cannot process payment until you have completed and submitted the fully executed required documentation.

If your Submission qualifies for a Bounty, please note:

You may not designate someone else as the Bounty recipient unless you are considered a minor in your place of residence;
If you are eligible for this Program but are considered a minor in your place of residence, we may award the Bounty to your parent/legal guardian on your behalf and require them to sign all required forms on your behalf. The Bounty will be added to the taxable income of your parent/legal guardian;
If you are unable or unwilling to accept your Bounty, we reserve the right to rescind it; and
If you accept a Bounty, you will be solely responsible for all applicable taxes related to accepting the payment(s).

Privacy

See the LiquidPixels Privacy site relating to the collection and use of your information in connection with the Program.

Public Recognition

LiquidPixels may publicly recognize individuals who have been awarded Bounties. LiquidPixels, at its discretion, may recognize you on web properties or other printed materials unless you explicitly ask us not to include your name with your initial submission or in writing up to 30 calendar days after your initial submission.

Code of Conduct

By participating in the Program, you will follow these rules:

Do not do anything illegal.
Do not engage in any activity that exploits, harms, or threatens to harm children.
Do not send spam. Spam is unwanted or unsolicited bulk email, postings, contact requests, SMS (text messages), or instant messages.
Do not share inappropriate content or material (involving, for example, nudity, bestiality, pornography, graphic violence, or criminal activity).
Do not engage in activity that is false or misleading.
Do not engage in activity that is harmful to you, the Program, or others (e.g., transmitting viruses, stalking, posting terrorist content, communicating hate speech, or advocating violence against others).
Do not infringe upon the rights of others (e.g., unauthorized sharing of copyrighted material) or engage in activity that violates the privacy of others.
Do not help others break these rules.

If you violate these Terms, you may be prohibited from participating in the Program in the future and any Submissions you have provided may be deemed to be ineligible for Bounty payments.

No Warranties

LIQUIDPIXELS, AND OUR AFFILIATES, RESELLERS, DISTRIBUTORS, AND VENDORS, MAKE NO WARRANTIES, EXPRESSED OR IMPLIED, GUARANTEES OR CONDITIONS WITH RESPECT TO THE PROGRAM. YOU UNDERSTAND THAT YOUR PARTICIPATION IN THE PROGRAM IS AT YOUR OWN RISK. TO THE EXTENT PERMITTED UNDER YOUR LOCAL LAW, WE EXCLUDE ANY IMPLIED WARRANTIES IN CONNECTION WITH THE PROGRAM. YOU MAY HAVE CERTAIN RIGHTS UNDER YOUR LOCAL LAW. NOTHING IN THESE TERMS IS INTENDED TO AFFECT THOSE RIGHTS, IF THEY ARE APPLICABLE.

Limitation of Liability & Binding Arbitration

If you have any basis for recovering damages in connection with the Program (including breach of these Terms), you agree that your exclusive remedy is to recover, from LiquidPixels or any affiliates, resellers, distributors, third-party providers, and vendors, direct damages up to $100.00. You cannot recover any other damages or losses, including direct, consequential, lost profits, special, indirect, incidental, or punitive. These limitations and exclusions apply even if this remedy does not fully compensate you for any losses or fails of its essential purpose or if we knew or should have known about the possibility of the damages. To the maximum extent permitted by law, these limitations and exclusions apply to anything or any claims related to these Terms and the Program.

Limitation of Liability & Binding Arbitration

(If you live in, or, if your principal place of business is in the United States)

We hope we never have a dispute, but if we do, you and we agree to try for 60 days to resolve it informally. If we cannot, you and we agree to binding individual arbitration before the American Arbitration Association (“AAA”) under the Federal Arbitration Act (“FAA”), and not to sue in court in front of a judge or jury. Instead, a neutral arbitrator will decide and the arbitrator’s decision will be final except for a limited right of review under the FAA. Class action lawsuits, class-wide arbitrations, private attorney-general actions, and any other proceeding where someone acts in a representative capacity are not allowed. Nor is combining individual proceedings without the consent of all parties. “We,” “our,” and “us” includes LiquidPixels and LiquidPixels affiliates. Disputes covered—everything except IP. The term “dispute” is as broad as it can be. It includes any claim or controversy between you and us concerning the Program or these Terms, under any legal theory including contract, warranty, tort, statute, or regulation, except disputes relating to the enforcement or validity of your, your licensors’, our, or our licensors’ intellectual property rights.

Mail a Notice of Dispute first. If you have a dispute, send a Notice of Dispute by U.S. Mail to LiquidPixels, 44 Manning Road, Suite 100, Billerica, MA 01821 USA. Tell us your name, address, how to contact you, what the problem is, and what you want. We will do the same if we have a dispute with you. After 60 days, you or we may start an arbitration if the dispute is unresolved.

Arbitration Fees and Payments

Disputes Involving $75,000 or Less
We will promptly reimburse your filing fees and pay the AAA’s and arbitrator’s fees and expenses. If you reject our last written settlement offer made before the arbitrator was appointed, your dispute goes all the way to an arbitrator’s decision (called an “award”), and the arbitrator awards you more than this last written offer, we will: (i) pay the greater of the award or $1,000; (ii) pay your reasonable attorney’s fees, if any; and (iii) reimburse any expenses (including expert witness fees and costs) that your attorney reasonably accrues for investigating, preparing, and pursuing your claim in arbitration.

Disputes Involving More than $75,000
The AAA rules will govern payment of filing fees and the AAA’s and arbitrator’s fees and expenses.

Conflict with AAA Rules
These Terms govern to the extent they conflict with the AAA’s Commercial Arbitration Rules or Consumer Arbitration Rules.

Must File Within One Year
You and we must file in small claims court or arbitration any claim or dispute (except intellectual property disputes) within one year from when it first could be filed. Otherwise, it is permanently barred.

Rejecting Future Arbitration Changes
You may reject any change we make to this section (except address changes) by sending us notice within 30 days of the change by U.S. Mail to the address in section (b). If you do, the most recent version of the section before the change you rejected will apply.

Severability
If the class action waiver is found to be illegal or unenforceable as to all or some parts of a dispute, then those parts will not be arbitrated but will proceed in court, with the rest proceeding in arbitration. If any other provision of this section is found to be illegal or unenforceable, that provision will be severed but the rest of this section still applies.

Place to Resolve Disputes

If you live in (or, if a business, your principal place of business is in) the United States, the laws of the State of New York govern all claims, regardless of conflict of laws principles, except that the Federal Arbitration Act governs all provisions relating to arbitration. You and we irrevocably consent to binding arbitration described herein to be held in Middlesex County, Massachusetts, for all disputes arising out of or relating to these Terms or the Program.

Miscellaneous

These Terms, the LiquidPixels Privacy Statement, and any applicable Product Program Terms are the entire agreement between you and LiquidPixels for your Participation in the Program. It supersedes any prior agreements between you and LiquidPixels regarding your participation in the Program. All parts of these Terms apply to the maximum extent permitted by relevant law. If a court or arbitrator holds that we cannot enforce a part of these Terms as written, we may replace those terms with similar terms to the extent enforceable under the relevant law, but the rest of these Terms will not change.

Unsolicited Ideas

Other than your Submission, LiquidPixels does not consider or accept unsolicited proposals or ideas, including without limitation ideas for new products, technologies, promotions, product names, product feedback, and product improvements (“Unsolicited Feedback”). If you send any Unsolicited Feedback to LiquidPixels through the Program or otherwise, LiquidPixels makes no assurances that your ideas will be treated as confidential or proprietary.

IF YOU DO NOT AGREE TO THESE TERMS, PLEASE DO NOT SEND US ANY SUBMISSIONS OR OTHERWISE PARTICIPATE IN THIS PROGRAM.