Report a Security Issue

watchmycreation is operated by Sajai Digital (sole proprietorship), Flat No. 1101, J Wing, Empire Square, Kalewadi Road, Near KWT Tower, MIDC Chinchwad, Pimpri Chinchwad, Pune, Maharashtra 411019, India. Contact support@watchmycreation.com or +91 98504 69469.

What to include

• What the issue is and what someone could do with it.
• The page, address or request involved, and the steps to reproduce it.
• Any proof of concept, screenshots or logs, with personal data removed.
• How you would like to be credited, if at all.

What we promise

• We acknowledge your report within 2 working days.
• We tell you what we found, and our plan, within 10 working days, and keep you informed until it is fixed.
• We will not take legal action against you, or ask anyone else to, for research done in good faith within the rules below.
• With your permission, we credit you once the issue is fixed.

We do not run a paid bug bounty.

The rules

• Test only against your own account, your own films and tickets you bought. Never access, change or delete anyone else’s data; if you reach it by accident, stop and tell us.
• Do not degrade the service for others: no denial-of-service, load or spam testing, and no automated scanning that sends a large volume of requests.
• No social engineering of our team, filmmakers or viewers, and no physical attacks.
• Do not publish or share the issue until it is fixed, or until 90 days after your report, whichever comes first, unless we agree otherwise.

Out of scope

• Screen recording of a film: no web player can fully prevent it, and we do not claim to.
• That a ticket link works for whoever holds it: by design, the link is the ticket.
• Reports from automated tools with no demonstrated impact, missing best-practice headers with no exploit, and issues in third-party services (Cloudflare, Razorpay, YouTube, Vimeo), which should go to them.

For anything that is not a security issue, see Contact Us.