Find a bug,
earn a reward.
Help us keep Play Digital Signage secure. We reward security researchers who report vulnerabilities responsibly.
Rewards by
severity.
The more harm a bug could do, the bigger the reward.
Up to $1,000
CriticalFor example, gaining access to a critical server in our infrastructure.
Around $500
MediumMedium-severity bugs.
Around $150
LowLow-severity bugs.
How it
works.
We aim to be objective, reward hard work and keep the people who help secure our service motivated.
Report the bug
Describe how the bug could be used in a real attack and how you would fix it.
Send a reportWe fix it and assess the severity
We fix the bug first, then judge how severe it is.
You get a reward offer
We get back to you with a proposed reward. Think we misjudged the severity? Tell us, with more examples of how the bug can be used.
What we
don't reward.
These are known issues or out of scope. Some we can't fix without breaking compatibility.
DDoS, brute force and phishing
Denial-of-service and brute-force attacks are out of scope, as is social engineering of our users (phishing, vishing, smishing).
Scripts in the web preview
Scripts can run in the web preview's iframe so external widgets can be embedded. It runs on a separate domain to prevent cookie theft. We only reward a working attack, with a demonstration and a fix, not e.g. a fake password prompt.
EXIF data in uploads
EXIF data isn't stripped from uploaded files. Uploads are mostly private, so this isn't a vulnerability.
Proxy redirects
proxy.playsignage.com can be tricked into redirecting to another domain. We know, and can't fix it without breaking compatibility.
Public playlist endpoint
Anyone who knows a playlist's ID can read it through the API. This is on purpose, so preview links can be shared.
Locked objects
Object locking is checked in the editor only, so the API still accepts changes to locked elements. Only trusted team members have access to a playlist, so the risk is negligible.
Found a vulnerability?
Read our disclosure rules, then send us your report.