Running it
Tell them, immediately and plainly
Delay is the part that turns an incident into a betrayal.
Guides on Running it: The admin that turns income into a trade
If material a buyer sent you ends up somewhere it should not be, the thing that determines how badly this goes is not the leak. It is how long it takes you to say so.
An incident disclosed within the hour is an accident. The same incident disclosed after the buyer finds out independently is a cover-up, and no explanation recovers from that.
The first hour
Four actions, in this order, and none of them are drafting an apology.
Contain. Take down what you can take down, revoke what you can revoke, change the credential that failed. If a shared link is the vector, kill the link before anything else.
Establish scope. Which buyer, which job, which file, and from when to when it was exposed. Guessing wide is better than guessing narrow; you can revise downward later, and revising upward destroys the trust the first message bought.
Notify. The buyer first, the platform second, on the same day.
Write it down. Times, actions, what you knew when. You will not remember this accurately in a week, and if anything formal follows, the contemporaneous note is the only version anyone believes.
What the message says
Short, factual, no self-defence.
What happened, what was exposed, when, what you have done, what you are doing next, and how they can reach you. Then the sentence most people omit: an offer to refund the job in full without being asked.
Do not explain the technical cause at length. Do not describe how unlikely it was. Do not use the word "unfortunately". A person reading that message wants to know whether their material is still out there and whether you are on top of it, and every additional clause pushes those answers further down.
If you do not yet know the full extent, say that explicitly, give a time you will update them, and then actually update them at that time even if nothing has changed.
Platform and legal reporting
Report to the platform even when the leak happened entirely on your side. They may be able to help, they will find out eventually, and self-reporting is treated very differently from being reported.
Whether you have a legal notification duty depends on where you and the buyer are, and this differs by country - check yours rather than assuming. Several jurisdictions attach short deadlines, counted in days, to personal data breaches, and the threshold for what counts is lower than most people expect. In the UK, for example, the Information Commissioner's Office expects a reportable breach to be notified "where feasible within 72 hours". If intimate images have been posted publicly, the US TAKE IT DOWN Act now helps the person depicted: since 19 May 2026, the FTC says covered platforms must remove them, and known identical copies, within 48 hours of a valid request. This is not legal advice and nothing here substitutes for asking someone qualified in your own jurisdiction.
Prevention is most of the answer
The incident response above is the small part. Almost every leak a single earner suffers comes from one of four causes, and all four are cheap to close.
| Cause | The fix |
|---|---|
| Sync picking up a downloads folder | Store submissions outside every watched directory |
| Files kept long after delivery | Delete at the end of the dispute window |
| A shared link with no expiry | Expiring links only, or no links at all |
| Device lost, no encryption | Full-disk encryption, on today |
The single highest-value one is retention. Material you no longer hold cannot leak, and the case for holding almost nothing is worked through in the post on what you keep and for how long. The rest is device hygiene, which overlaps with the minimal toolset argument: each additional app that touches client files is another place a copy can persist without your knowledge.
The reputational arithmetic
Earners overestimate how much a disclosed incident costs and underestimate how much a concealed one does.
A buyer told promptly, refunded without argument and kept informed will frequently stay. The behaviour reads as someone who takes the material seriously, which is the thing they were worried about in the first place. A buyer who discovers it themselves tells other people, and in a trade where discretion is the product, that story travels further than any review.
This is also why the platform conversation matters. Buyers form their expectations of how a commission is handled from the norms of the marketplace rather than from you personally, and the buyer-side account of those norms is a useful corrective to the assumption that they will be unreasonable. Their expectations about images specifically are documented in what buyers assume happens to a submitted photo, and they are stricter than the average brief implies. Automated services publish retention and deletion terms as a matter of course, and how an automated service states its handling is a reasonable model for the two sentences you should be able to say about your own.
For the platform-side reporting route, including who to contact and what a judge is expected to disclose, Rate Cock's judges page is where that sits.
The uncomfortable truth is that the hour after a leak is not when you decide how to behave. It is when you find out what you already decided, months earlier, when you chose where the files would live.