How to report
Email security@lastwatched.com with the affected surface, impact, reproduction steps, and a safe way to validate the issue.
The mailbox must be verified as monitored before public launch. This review version does not promise a response or remediation timeline.
Research boundaries
- Do not access, change, retain, or disclose another person’s data.
- Do not degrade availability or test denial-of-service techniques.
- Do not test TMDB, JustWatch, Apple, Cloudflare, email providers, or another third party through Last Watched.
- Do not use social engineering, physical intrusion, or credential stuffing.
- Stop and report if testing exposes secrets or personal information.
Useful report details
- the exact app version, route, or component;
- prerequisites and minimal reproduction steps;
- observed and expected behavior;
- likely impact and affected data;
- logs or screenshots with secrets and personal data removed;
- a proposed fix, if you have one.
Supported scope
The current platform scope is the public website and its build and deployment configuration. Future hosted services will publish service-specific supported-version and reporting details before they handle user data.