Log in

Vulnerability Disclosure Policy

Last updated October 2026

PlayHouse (https://playhouse.fans) is owned and operated by Vallara, Inc. ("Vallara", "we", "us" or "our"). We welcome reports from security researchers who help us keep PlayHouse and our Users' information secure. This policy explains what you may test, how to test it, how to report what you find, and the legal safe harbor we give researchers who follow it.

Contents

  1. How to report a vulnerability
  2. What happens after you report
  3. Scope
  4. Out of scope
  5. Rules of engagement
  6. Who may take part
  7. Safe harbor
  8. Coordinated disclosure
  9. Your report
  10. Questions and changes

1. How to report a vulnerability

1.1 Submit reports through our vulnerability disclosure program: submit a vulnerability report. You can also reach it from our Security Reporting page. Please do not report vulnerabilities through our help center or social media.

1.2 A good report includes:

  • a description of the vulnerability and where it is (the URL, endpoint or feature);
  • clear steps to reproduce it, including any tools you used;
  • a proof of concept that shows the impact, using only your own accounts or test data;
  • the impact you believe it has; and
  • whether you accessed any data that is not yours (see section 5).

1.3 Please put any scripts or exploit code in a non-executable file type, and give attachments descriptive names.

2. What happens after you report

2.1 We aim to acknowledge reports that follow this policy promptly.

2.2 We will work to validate your report, decide whether and how to fix it, and keep you informed of its status through the program. Every vulnerability is different, so the timing and detail of our updates will vary. We may contact you to ask for more information.

2.3 Submitting a report does not by itself entitle you to a reward or payment.

3. Scope

3.1 This policy covers:

  • the PlayHouse web app at playhouse.fans, including when it is installed as a progressive web app;
  • Fan, Creator and Agency accounts and the features available to them, including sign-in, messaging, uploads, subscriptions, purchases, the wallet and payouts; and
  • the PlayHouse application programming interfaces (APIs) that the web app uses.

3.2 If you are not sure whether something is in scope, ask through the program before you test it.

4. Out of scope

4.1 The following are out of scope. Do not test them:

  • services operated by third parties, even where they appear under a PlayHouse name or domain, including our payment processor, our identity verification provider (including any of its pages that appear under a PlayHouse domain) and the platform that hosts our vulnerability disclosure program. Please report vulnerabilities in those services to the provider concerned. If you believe a third-party issue affects PlayHouse Users, you may also tell us through the program;
  • internal and staff systems that are not intended to be reachable from the public internet. If you find one that is reachable, report it without testing it further;
  • physical security, and social engineering or phishing of our staff, contractors or Users; and
  • denial-of-service testing, load testing, and any testing that could degrade the availability of PlayHouse.

4.2 We generally do not accept reports of the following unless you can show a significant, practical security impact:

  • findings from automated scanners without a working proof of concept;
  • missing security headers or cookie flags, or software version disclosure;
  • clickjacking on pages with no sensitive actions;
  • self-XSS, or issues that need an unlikely degree of user interaction;
  • content injection or text spoofing without a demonstrated attack;
  • email configuration issues (such as SPF, DKIM or DMARC settings);
  • issues that affect only outdated or unsupported browsers; and
  • issues that need physical access to a device, or a rooted or jailbroken device.

5. Rules of engagement

5.1 When you test PlayHouse, you must:

  1. test only systems that are in scope, and only using accounts you own or accounts whose owner has given you explicit written permission, which you must show us on request;
  2. stop testing and report to us promptly once you have found a vulnerability, or as soon as you see that you have access to data that is not yours;
  3. access, view or keep only the minimum data needed to show the vulnerability, and never download, copy, share or keep other Users' Content, messages, personal information or identity verification data;
  4. if you access someone else's data by accident, stop, tell us in your report what you accessed, and delete it from your systems;
  5. delete any data you collected while testing once you have reported it;
  6. make a good-faith effort to avoid privacy violations, destruction or alteration of data, and interruption or degradation of PlayHouse; and
  7. comply with all laws that apply to you.

5.2 You must not:

  1. exploit a vulnerability beyond what is needed to show it, including to move into other systems, establish persistent access, or exfiltrate data;
  2. view, unlock or download paid Content without paying for it, or obtain money, wallet credit, refunds or payouts that you are not entitled to, other than the minimum needed to show the vulnerability, which you must disclose in your report;
  3. make payments with a card or account you are not authorized to use;
  4. submit another person's identity documents or images, or forged or altered documents, to our identity or age verification processes;
  5. upload sexually explicit material, images of real people other than yourself, or any unlawful material to test uploads; use harmless test images instead;
  6. send spam or unsolicited messages to Users, or contact Creators, Fans or Agencies as part of your research; or
  7. introduce malware, or delete, alter or encrypt our data or our Users' data.

5.3 If you come across anything that appears to be child sexual abuse material, stop immediately. Do not download, copy or share it. Report it to us through the program and to NCMEC's CyberTipline at report.cybertip.org.

6. Who may take part

6.1 To take part, you must:

  • be at least 18 years old and old enough to view adult content where you live;
  • not be a resident of, or make your submission from, a country or region subject to comprehensive US sanctions or trade restrictions, and not be named on a US sanctions list; and
  • not be an employee or contractor of Vallara, or an immediate family or household member of one.

7. Safe harbor

7.1 If you make a good-faith effort to comply with this policy, we consider your security research to be authorized, and:

  1. we will not bring, and will not support, legal action against you, or report you to law enforcement, for research carried out in accordance with this policy (this does not affect our legal duty to report apparent child sexual abuse material, see section 5.3). This includes claims under the Computer Fraud and Abuse Act (18 U.S.C. §1030), similar state laws, and the anti-circumvention provisions of the Digital Millennium Copyright Act (17 U.S.C. §1201);
  2. to the extent your research under this policy would otherwise breach our Terms of Service or Acceptable Use Policy, we waive those restrictions for the limited purpose of that research; and
  3. if a third party brings legal action against you for activities that we determine complied with this policy, we will take steps to make it known that your activities were authorized under this policy.

7.2 We will not pursue legal action against you for accidental violations of this policy that you made in good faith and told us about promptly.

7.3 This safe harbor covers only Vallara's own claims and systems. We cannot authorize testing of systems that belong to third parties.

7.4 This policy does not authorize you to access any person's data or account without their consent, beyond what section 5 allows. It is consistent with the US Department of Justice's policy on charging cases under the Computer Fraud and Abuse Act, which directs that good-faith security research should not be charged.

7.5 If you are unsure whether a test is consistent with this policy, ask us through the program before you carry it out.

8. Coordinated disclosure

8.1 Disclosing a vulnerability before a fix is available can put our Users at greater risk. Please do not share information about a vulnerability you report with anyone else, or disclose it publicly, until we have fixed it or until 90 days after we have acknowledged your report, whichever is sooner, unless we agree a different date with you through the program.

8.2 If you believe others should be told about a vulnerability before we have fixed it, please discuss it with us through the program first.

8.3 We may share vulnerability reports with affected vendors. We will not share your name or contact details without your permission.

9. Your report

9.1 By submitting a report, you confirm that it, and anything attached to it, does not infringe anyone else's rights. You grant Vallara a non-exclusive, royalty-free, worldwide, perpetual license to use, reproduce, adapt and publish the report and its attachments for the purpose of securing our services and informing our Users and affected vendors.

9.2 Your use of PlayHouse remains subject to our Terms of Service and Privacy Policy, except as section 7.1 provides.

10. Questions and changes

10.1 Questions about this policy, and suggestions for improving it, can be sent through our vulnerability disclosure program.

10.2 We may update this policy from time to time. We will post the updated version on this page and change the "Last updated" date below.