- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 6
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 3 days
- As the policy promises.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
We do not offer a bug bounty, but every actionable report is reviewed and prioritized based on its impact.
- Response
-
Within 3 days
We will acknowledge receipt within 72 hours and be transparent about what we find and what we can reasonably do.
- Safe harbor
-
Partial
If you accidentally stumble upon something sensitive, stop and let us know - we will keep it confidential and work with you, not against you
- Hall of fame
-
Yes
Responsible researchers are publicly credited in our Hall of Fame.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
6 assets you may test, 4 excluded.
Domains 3
- api.workoutgen.app
- my.workoutgen.app
- workoutgen.app
Wildcard domains 1
- *.workoutgen.app
Products and areas 2
- all our associated services
- our iPhone, Android, and Windows apps
Out of scope (4)
- browser extensions
- local malware
- self-XSS without privilege boundaries
- third-party behavior with no demonstrated impact on WorkoutGen
Rules
What the policy asks of you, and the bug types it won't reward, quoted from WorkoutGen's policy. "We" in these lines means the program, not this site.
While testing
-
Do not access user data beyond what is strictly necessary to prove the existence of the vulnerability
-
Do not perform denial of service tests - our infrastructure is tight and every request has a cost
-
No social engineering, phishing, or physical attacks
-
Please keep testing rate-limited and avoid any automation that could degrade the service
-
Please mask active tokens, secrets, and personal data before sending proof
Not accepted
-
Reports that rely solely on browser extensions
-
local malware
-
self-XSS without privilege boundaries
-
third-party behavior with no demonstrated impact on WorkoutGen
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope
+ api.workoutgen.app
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.