Help keep our
community safe.

A clear, careful approach.

What to report

We welcome reports about Kids Club’s website at kidsclub.ph (including www) and our app at app.kidsclub.ph: for example, unintended access, exposed information or a weakness in an account or file-access check.

Research boundaries

You may report issues discovered through normal use, passive inspection of public pages, or an account you are already authorized to use. Before active probing, automated scanning or testing access controls, contact us to agree written permission, a suitable test environment and any necessary hosting-provider approval.

• Use only your own authorized accounts and synthetic test information. Do not seek access to children’s or other people’s records.
• Stop immediately if you encounter private information. Tell us where it appeared without copying, downloading, changing or sharing it.
• Do not run denial-of-service tests, password attacks, phishing, social engineering, malware or persistence. Do not alter or delete records, trigger payments, send messages to families or disrupt service.
• Third-party infrastructure, email providers, Euka and other linked services are outside this program. We cannot authorize testing of another provider’s systems.

Good-faith reporting

Kids Club will not pursue legal action against researchers for good-faith reporting or research that follows these boundaries and any written permission we provide. This commitment applies to Kids Club; it does not grant permission on behalf of third parties or override applicable law.

Working toward a fix

Give us enough information to reproduce the issue safely. We aim to acknowledge reports within three business days and provide an initial assessment or progress update within ten business days. These are response targets, not a guarantee of a fix by a particular date.

Please coordinate a reasonable disclosure date with us before publishing technical details, so we can protect affected people. We will discuss remediation and keep you informed. Recognition is by mutual agreement; we will not publish your name without permission.

Your contact details

A name or researcher handle and a working email address are required so we can follow up. We use your report and contact details to assess and resolve the issue, and may share relevant technical details with the service providers helping us fix it. See our privacy notice. Do not send passwords, login codes, identity documents or identifiable family data.