Responsible Disclosure Policy

In simple words

Found a security problem in FitOS? Email support@fitosapp.in with the subject "Security".

This covers https://fitosapp.in, the FitOS App and its APIs.

Test only on your own trial Account. Never touch real gyms' data.

Do not take data, slow down the Service, or trick people.

If you follow these rules in good faith, we will not take legal action against you.

We reply within 3 business days and finish our first review within 10 business days.

We do not pay bug bounties, but with your permission we thank you publicly.

1. Our approach

1.1 FitOS holds data for gyms and their Members, so we take security reports seriously. No software is free of bugs. If you find a weakness, we want to hear from you before anyone else can misuse it.

1.2 "FitOS", "we", "us" and "our" mean ApexGrid, a sole proprietorship operating FitOS (an ApexGrid product) from Sikar, Rajasthan, India. Other capitalised words have the meaning given in our Terms of Service.

2. How to report

2.1 Email support@fitosapp.in with the subject line "Security". Our machine-readable contact file is at https://fitosapp.in/.well-known/security.txt.

2.2 Please include:

what the problem is and where it is (URL, App screen or API endpoint);
clear steps to reproduce it, using your own test Account;
what an attacker could do with it;
screenshots or a short video, if helpful;
whether you would like to be thanked publicly, and the name or handle to use.

2.3 Write in English or Hindi. Please keep the details private until we have fixed the problem or agreed a disclosure date with you.

3. Scope

3.1 In scope:

the Website at https://fitosapp.in and its sub-domains run by us (for example, app.fitosapp.in if and when used);
the FitOS Android App (and the iPhone app, once released);
the APIs and backend that the Website and App use.

3.2 Out of scope:

services run by our providers (such as Supabase, Netlify, Cloudflare, Brevo, Google Play, Expo or Sentry). Report problems in their platforms to them directly;
reports from automated scanners without a working proof of impact;
missing security headers, cookie flags or email (SPF/DKIM/DMARC) settings without a real, demonstrated attack;
clickjacking on pages with no sensitive action;
self-XSS, or attacks that need a rooted or already-compromised device;
rate-limiting or spam issues on forms that are already protected by bot checks, unless you show a real bypass;
denial-of-service of any kind;
social engineering, phishing or physical attacks;
issues in outdated browsers or Android versions we do not support.

4. Rules for testing

4.1 Use only your own trial Account. Create a gym on a free trial and test there. Never access, change or delete data of any real gym, Gym Owner, Trainer or Member.

4.2 Prove, do not take. If you reach data that is not yours, stop. Collect only the minimum needed to prove the issue (for example, one record ID), do not download, keep or share it, and tell us at once.

4.3 No disruption. Do not run denial-of-service tests, load tests, or anything that could slow down or break the Service for others.

4.4 No social engineering. Do not phish, call, message or trick our team, gyms or users.

4.5 No spam. Do not flood our forms, emails or notifications.

4.6 No malware or backdoors. Do not plant code or leave anything behind.

4.7 Keep it confidential. Do not publish or share the issue until we have fixed it or agreed a date with you.

4.8 Follow the law. Do not break any law while testing.

5. Safe harbour

5.1 If you act in good faith and follow this policy, we will not pursue legal action against you, or file a complaint against you with the police, for your research. For this purpose we treat your testing on your own trial Account as authorised by us. This never authorises access to any other gym's or person's data.

5.2 This promise covers only FitOS systems that we control. We cannot give permission on behalf of our providers or other people. It does not apply if you break the rules in section 4, act in bad faith, demand money, or threaten to publish data.

5.3 We may still have legal duties, for example to report a security incident to the authorities. If that happens, we will explain that your report was made in good faith under this policy.

6. What to expect from us

6.1 Acknowledge: within 3 business days of your report.

6.2 Triage: within 10 business days we tell you whether we can reproduce the issue, how serious we think it is, and our plan.

6.3 Updates: we keep you informed while we work on a fix and tell you when it is fixed.

6.4 Credit: we will not share your name without your permission.

6.5 These are targets we work hard to meet. Complex issues may take longer to fix, and we will tell you if so.

7. Rewards and thanks

7.1 FitOS is a small business. We do not run a paid bug bounty and do not pay for reports.

7.2 With your permission, we will thank you by name or handle on our hall of thanks, below, after the issue is fixed.

8. Hall of thanks

8.1 We are grateful to the people who have helped keep FitOS safe. Names appear here with their permission.

No reports yet. You could be the first.