I noticed something on the plex.tv website, I haven't looked into it yet as I wanted to reach out first.
Do you have any guidelines for responsible security disclosure and testing of your site?
Alternatively please have a representative from your security team contact me.
