If you find a security vulnerability on PlayerBay, report it privately to [email protected] with steps to reproduce it. Our team reviews every report. Valid reports of issues we didn’t already know about can earn a reward based on severity and impact. Test only on your own accounts and data, and don’t disclose the issue until we’ve fixed it.
How to report
- Email [email protected]. If you’re signed in, you can also use the contact page and choose Security issue.
- Include the details below.
- Our team reviews the report, confirms the issue and assesses its impact. We reply within 2 days, often sooner.
Contact us
What to include
| Detail | What to send |
|---|---|
| Summary | A short description of the issue. |
| Steps to reproduce | Clear steps our team can follow to confirm it. |
| Impact | What an attacker could do with it: accounts, payments, listings, user data or the platform. |
| Proof of concept | Screenshots, a video or example requests that show the issue safely. |
| Accounts used | The PlayerBay accounts you tested with. |
Testing rules
- Test only with your own accounts and your own data.
- Don’t access, change, delete, download or expose anyone else’s data.
- Don’t change orders, balances, listings, accounts or payments that aren’t yours.
- Don’t run denial-of-service attacks, load tests or spam.
- Don’t try social engineering on users, sellers, support staff or employees.
- Don’t use destructive testing methods.
- Don’t disclose the issue publicly until we’ve reviewed and fixed it.
If you follow these rules and act in good faith, we won’t take legal action against you for your research.
Rewards
Rewards depend on the issue’s severity and impact, the quality of the report, and whether it’s valid, reproducible and new to us. You choose how we pay a reward: in cash, or as a voucher for PlayerBay purchases.
Not every report qualifies. Reports that are unclear, duplicates, low impact, outside these rules or not about PlayerBay’s security don’t earn a reward.