Leadsquared Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://www.leadsquared.com/security/
policy:
  - https://www.leadsquared.com/security/
contact:
  - security@leadsquared.com
security_txt: false
security_txt_note: >-
  No /.well-known/security.txt is served on any LeadSquared host — see
  well-known/leadsquared-well-known.yml. The program is published as an HTML page
  only, so an automated RFC 9116 lookup finds nothing. The mechanical
  probe-security-programs.py pass returned vdp=none for exactly this reason; this
  file is the SEARCHED upgrade over that miss.
bug_bounty:
  platform: none
  paid: false
  note: >-
    Self-hosted program, no HackerOne/Bugcrowd/Intigriti listing. Recognition is a
    "Hall of Fame" acknowledgement rather than a bounty; LeadSquared/MarketXpander
    employees and family members are excluded.
program:
  response_commitment: within 48 hours of submission
  public_disclosure_allowed: false
  public_disclosure_policy: >-
    "THIS PROGRAM DOES NOT ALLOW PUBLIC DISCLOSURE. ONE SHOULD NOT RELEASE THE
    INFORMATION ABOUT VULNERABILITIES FOUND IN THIS PROGRAM TO PUBLIC, FAILING WHICH
    SHALL BE LIABLE FOR LEGAL PENALTIES!"
  testing_restrictions: >-
    "Please refrain from doing security testing in existing customer accounts."
  commitments:
    - Acknowledge receipt of the vulnerability report in a timely manner
    - Investigate and provide an estimated time frame for addressing it
    - Notify the reporter when the vulnerability has been fixed
  terms_note: LeadSquared reserves the right to modify or terminate the program at any time.
other_contacts:
  - {purpose: privacy/GDPR, email: privacy@leadsquared.com}
evidence:
  - source: https://www.leadsquared.com/security/
    http_status: 200
    fetched: '2026-08-13'
    keywords: [responsible disclosure, vulnerability, Hall of fame, 48 hours, public nondisclosure]
    matched_emails: [security@leadsquared.com, privacy@leadsquared.com]