● SEC / OPS — Responsible Disclosure

TeleLive Bug Bounty

Found a bug? Nice work — open a ticket. Critical security issue? Call us and say code 4.

Open ticket Security call
telelivee.ir + API
Responsible disclosure
Code 4 = security

Bug report

Submit report (ticket)

Technical bugs, UI, account, or content — use the form below.

Clear reports with PoC and repro steps get reviewed faster. Thanks for helping secure TeleLive.

Clearer reports get reviewed faster. Up to 5000 characters.
No file selected
No file selected
txt, log, pdf, zip, or json — max 10MB

Scope

telelivee.ir

Main website, dashboard, live streaming, chat, payments, and accounts.

API & realtime services

Official /api/* endpoints and TeleLive services on this domain.

WebSocket / Socket.IO

Live chat and realtime via telesocket.liara.run (Socket.IO).

Out of scope

DoS, phishing, social engineering, automated scans without PoC, third-party, unofficial subdomains.

Severity guide

Critical

RCE, mass sensitive data exposure, SQL/command injection with high impact.

High

Account takeover, sensitive IDOR, high-impact SSRF, stored XSS with privilege escalation.

Medium

State-changing CSRF, reflected XSS, limited information disclosure.

Low

Minor misconfigurations without direct exploit, GET open redirects.

Bug bounty rewards

After a valid fix, the team may grant one of the rewards below. The Bug Reporter badge and achievement unlock automatically on Resolve.

Critical — up to 500 Tele or 1 month Ultra
High — up to 250 Tele or a Tier-1 gift sub
Medium — up to 100 Tele
Low — Bug Reporter badge & achievement

Rewards are granted after manual review; duplicates and out-of-scope reports are not eligible.

Bug hunters

Thanks to everyone who reported bugs and helped make TeleLive better.

GemGGo San @GemGGoSan 91 reports ews @AwakenTheRuiny 27 reports SyCo @SyCo 11 reports qa_audit_display @qa_audit_eaff 4 reports jojoo @jojoo 3 reports amiri @amiri1 2 reports arvindarktnt @arvindarktnt 2 reports Daniyallrz @Daniyallrz 2 reports GaniusLord @GaniusLord 2 reports kourosh_koh @kourosh_koh 2 reports testtest @testtest 2 reports (_K_i_l_l_e_r_) @_K_i_l_l_e_r_ 1 reports agtorab @agtorab 1 reports alidelta @alideltagame 1 reports AMIN_792 @AMIN_792 1 reports Ariss @Ariss 1 reports ArzTv @ArzTv 1 reports ata_begzfan @ata_begzfan 1 reports ataya @ataya 1 reports Barad @Barad 1 reports Farid3i @Farid3i 1 reports Farzad @Farzadino 1 reports Fury @Fury 1 reports GholamShelby @GholamShelby 1 reports

Rules & limits

  • 01Do not download, modify, or delete user data.
  • 02No DoS/DDoS, brute force, or spam.
  • 03Do not publicly disclose before we fix the issue.
  • 04One vulnerability per report; duplicates are merged.
  • 05Test only on your own assets or with the channel owner’s consent.
  • 06Automated scanner output without attack scenario and PoC is out of scope.