Security and Responsible Disclosure
How to report a security issue in a Livable plugin, what data leaves your site, what happens to your API keys on uninstall, and where our boundaries are.
How do I report a security problem?
Email security@livableforms.com with the plugin, the version, and enough detail to reproduce it. A human replies within two business days. Please do not open a public thread before we have shipped a fix — every site running the plugin is exposed until then.
The short version of our attack surface
- Your data never leaves your server — there is no Livable account holding your customers, so there is no Livable breach that could expose them.
- Every integration is off by default and nothing calls a third party until you add a key.
- Stored API credentials are always removed on uninstall, whether or not you opt into deleting anything else.
- Licence checking is advisory and never gates a feature, so an outage on our end cannot take your lead capture offline.
What we are not claiming
- We have not commissioned a third-party penetration test.
- We are not SOC 2 or ISO 27001 certified.
- We cannot secure your hosting, WordPress core, your other plugins or your passwords — most WordPress compromises come from those.