Security

Found a vulnerability? Tell me at [email protected] with “Security” in the subject. Machine-readable version: /.well-known/security.txt.

What I promise

• I will confirm your report and tell you what I found.
• I will not pursue legal action against you for research done in good faith under the rules below.
• I will credit you when I fix it, if you want the credit.
• I do not run a paid bounty programme. If that changes, this page changes with it.

What I ask

• Report privately first and give me reasonable time to fix it before you publish.
• Use your own data. Do not touch other users' data.
• No denial of service, no spam, no load testing against production.
• Do not use social engineering against me or my users.
• Stop as soon as you have proved the issue. You do not need to extract data to demonstrate access.

In scope

• The Log4Fit mobile app, on iOS and Android.
• My backend: the analytics endpoints and the database behind them.
• This website, at log4fit.com.

Out of scope

• Third-party services I use but do not run, including Expo, the Apple App Store, Google Play Store, and my hosting provider Hetzner. Report those to them.
• Findings from automated scanners with no demonstrated impact.
• Missing hardening headers or best-practice warnings with no exploit path.
• Reports that only show that the app can be modified on a rooted or jailbroken device.

What to include

• What you did, step by step, so I can reproduce it.
• What an attacker gains from it.
• The device, app version, and rough time you tested, so I can match it to my logs.
• Any screenshots or request captures that make it obvious.

Account and billing problems

This page is for vulnerabilities. For account or billing problems, contact me at [email protected] instead — that gets a faster answer.