Security Reporting
Last updated October 2026
We welcome reports from security researchers and anyone else who believes they have found a security vulnerability in PlayHouse. A vulnerability is a weakness that could allow someone to compromise the confidentiality, integrity or availability of PlayHouse or of our users' data.
Submit a report through our vulnerability disclosure program
Our security team reviews every report and keeps you informed through the program.
What is in scope?
At a high level, our Vulnerability Disclosure Policy covers:
- the PlayHouse web app at playhouse.fans;
- Fan, Creator and Agency accounts, including sign-in and account security;
- payments, wallets and payouts;
- messaging, media sharing and content delivery; and
- the PlayHouse APIs that support these services.
Out of scope are, among other things: social engineering or phishing of our staff or users, denial-of-service and load testing, physical security, and services run by third parties, such as our payment processor and our identity verification provider. The Vulnerability Disclosure Policy sets out the full scope and the testing rules.
What should my report include?
- a description of the vulnerability and its potential impact;
- the affected URL, endpoint or feature;
- clear steps to reproduce it, ideally with a proof of concept; and
- any screenshots or other material that will help us understand it.
Test only with accounts you own, or accounts whose owner has given you explicit written permission. Do not access, change or keep other users' data, and stop and tell us straight away if you come across it.
Safe harbor
If you make a good-faith effort to follow our Vulnerability Disclosure Policy, we will treat your research as authorized and will not pursue legal action against you for it. The policy sets out the safe harbor in full, and asks you to give us reasonable time to fix an issue before you disclose it publicly.
Not a security vulnerability?
- Problems with your own account, including if you think someone else has accessed it: use our contact form and choose My account or signing in.
- Harmful or illegal content: use the Report action on it, or our contact form and choose Report illegal or harmful content. Our Complaints Policy explains every route.
- Legal, privacy or law-enforcement requests: use our legal request form.