Palo Alto Software
Vulnerability disclosure program on HackerOne paloalto.com
- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 4
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report through their form
- HackerOne.com/palo_alto_software
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Safe harbor
-
Full
We will not pursue a civil action or initiate a complaint to law enforcement for accidental, good faith violations of this policy.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
4 assets you may test, 5 excluded.
Web 4
- app.liveplan.com Critical No bounty
- www.bplans.com Low No bounty
- www.liveplan.com Medium No bounty
- www.paloalto.com Medium No bounty
Out of scope (5)
- api.outpost.co
- app.outpost.co
- www.mplans.com
- www.outpost.co
- www.teamoutpost.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Palo Alto Software (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
You must keep information about any vulnerabilities you’ve discovered confidential between yourself and Palo Alto Software until we’ve had 90 days to respond
Not accepted
-
Social engineering or phishing attacks
-
Denial of service
-
Physical attacks against Palo Alto Software offices or employees
-
Issues found through automated testing
-
Any issues related to EmailCenterPro or found on any *.emailcenterpro.com site
-
Issues in outdated or obscure browsers (including IE 11, which we no longer support)
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 19 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Palo Alto Software Vulnerability Disclosure Policy
We take the security of our systems and our user’s data very seriously. If you believe you have found a security vulnerability in our systems we’d love to hear from you!
Program rules
You must make every effort to avoid the following during your research:
- privacy violations
- degradation of user experience
- disruption to production systems
- destruction of data
- You must keep information about any vulnerabilities you’ve discovered confidential between yourself and Palo Alto Software until we’ve had 90 days to respond
- You must follow HackerOne's disclosure guidelines.
We will do our part to respond as quickly as we’re able and to be as transparent as possible during the process. We appreciate your effort and want to make our applications as secure as possible.
If you sign up for any account on our systems (particularly for LivePlan or Outpost) specifically to test for security vulnerabilities, please use your @wearehackerone.com email alias (https://docs.hackerone.com/hackers/hacker-email-alias.html) so we can exclude you from labor intensive sales follow-up and from our conversion metrics.
Program Scope
The following websites and applications are in scope
- www.paloalto.com
- app.liveplan.com
- www.liveplan.com
- www.bplans.com
Program Exclusions
- Social engineering or phishing attacks
- Denial of service
- Physical attacks against Palo Alto Software offices or employees
- Issues found through automated testing
- Any issues related to EmailCenterPro or found on any *.emailcenterpro.com site
- Issues in outdated or obscure browsers (including IE 11, which we no longer support)
How to report your findings?
Please use our submission form at HackerOne to submit the vulnerability you’ve found. You may also email us at [email protected]
Safe Harbor
We will not pursue a civil action or initiate a complaint to law enforcement for accidental, good faith violations of this policy. If legal action is initiated by a third party against you and you have complied with Palo Alto Software’s vulnerability disclosure policy, Palo Alto Software will take steps to make it known that your actions were conducted in compliance with this policy.