Security Policy
Last updated:
WorkoutGen is a project built by two friends in France - one developer, one sports coach - with one simple goal: make personalized fitness free and accessible for as many people as possible.
If you found a vulnerability, please tell us. We cannot pay bug bounties - there is no VC behind this, just the two of us trying to keep the lights on. But we take every report seriously and will do everything we can to fix it fast.
Responsible researchers are publicly credited in our Hall of Fame. No reward beats knowing you helped protect thousands of people who are just trying to get healthier.
How to report a security issue
Email us directly. We respond within 48 hours - no ticketing system, no corporate black hole, just us.
Email: security@workoutgen.app
RFC 9116 file: /.well-known/security.txt
Please include
- Clear reproduction steps
- Measurable impact
- Affected scope (URL, endpoint, user flow)
- Proof of concept or screenshots when possible
Scope
This policy covers workoutgen.app, my.workoutgen.app, and all related services. If you are unsure whether something is in scope, ask first - we would rather have a false alarm than miss a real issue.
What we ask of you
- Do not access or copy user data beyond what is strictly needed to prove the vulnerability exists
- Do not run denial-of-service tests - our infrastructure is lean and we pay for every request
- No social engineering, phishing, or physical attacks
- If you accidentally access something sensitive, stop and tell us - we will keep it confidential and work with you, not against you
What you can expect from us
We will acknowledge your report within 48 hours and be transparent about what we find and what we can realistically do. We will not take legal action against good-faith security research.
We are a two-person team, so timelines depend on severity and complexity. Critical issues always get immediate attention.
Hall of Fame
These researchers chose to help instead of harm. We are grateful.
| Researcher | Finding | Specialty | Year | Profile |
|---|---|---|---|---|
| Pavan Baile | Clickjacking (X-Frame-Options) | Web Security | 2026 | |
| Siva Karthik Reddy | Broken Session Management | Red Teaming | 2026 | |
| Paladugu Gopichandu | Email Change Without Verification | Web Security | 2026 | |
| Sairam Batraju | Password Reset Rate Limiting | Web Security | 2026 | |
| Harshini Priya R | CORS Misconfiguration | Web Security | 2026 |