Security Policy

How to report a security issue

Email us directly. We respond within 72 hours - no ticketing system, no corporate black hole, just us.

Email: security@workoutgen.app

RFC 9116 file: /.well-known/security.txt

If you have multiple findings, please send them as separate reports when possible. One issue per email makes triage and credit much clearer for everyone.

Please include

• Clear reproduction steps
• Exact tested scope (URL, endpoint, user flow, account type, environment)
• Date and time of the test in UTC
• Measurable impact
• Sanitized request and response samples, logs, or HAR when relevant
• Proof of concept or screenshots when possible
• For session or replay issues, the exact delay between actions and whether the issue still happens after refresh or after 60+ seconds

Scope

This policy covers workoutgen.app, my.workoutgen.app, and all related services. If you are unsure whether something is in scope, ask first - we would rather have a false alarm than miss a real issue.

Findings that only depend on browser extensions, local malware, self-XSS without a privilege boundary, or third-party behavior without a demonstrated WorkoutGen impact are generally out of scope.

What we ask of you

• Do not access or copy user data beyond what is strictly needed to prove the vulnerability exists
• Do not run denial-of-service tests - our infrastructure is lean and we pay for every request
• No social engineering, phishing, or physical attacks
• If you accidentally access something sensitive, stop and tell us - we will keep it confidential and work with you, not against you
• Please keep testing rate-limited and avoid automation that could degrade the service
• Please redact live tokens, secrets, and personal data before sharing evidence

What you can expect from us

We will acknowledge your report within 72 hours and be transparent about what we find and what we can realistically do. We will not take legal action against good-faith security research.

We may classify a report as confirmed, partially confirmed, informational, or not reproducible. If we cannot validate part of a report, we will explain why.

We are a two-person team, so remediation timelines depend on severity and complexity. Critical issues always get immediate attention. Hall of Fame credit is discretionary and usually reserved for valid or materially helpful reports.

Hall of Fame

These researchers chose to help instead of harm. We are grateful.