Security claims should be specific and verifiable.
This page describes current practices and the safest way to report a suspected issue.
Scope
This page covers the FitBound mobile app and its backend services. It does not cover third-party services we link to but don't operate.
Accounts and access
FitBound accounts are authenticated through our backend provider (Supabase Auth). Row-level security is enabled on the data tables, and the app shows other players only what the Privacy Policy describes. For example, friends and guild-mates see your username, level and rank; leaderboards show season XP; your player card shows your workout streak and weekly consistency; and anyone with a workout share link can see that workout.
Server authority
Reward-affecting actions — like XP, currency, and inventory changes — are processed server-side rather than trusted from the client app. This is part of the current product design, not a claim that the system is immune to abuse; hardening this further is ongoing work.
What we don't claim
We don't use terms like “bank-grade,” “military-grade,” or claim SOC 2, HIPAA, penetration-tested, or bug-bounty status. If we don't have documented evidence for a security claim, we don't make it on this site.
Report a vulnerability
If you believe you've found a security issue, email security@fitboundonline.com with as much detail as you can safely include: affected endpoint or screen, steps to reproduce, and potential impact. Please don't include real account credentials, other people's data, or unnecessary personal health information in your report.
We don't currently run a paid bug-bounty program. We review reports as a small team and will acknowledge receipt, but we can't promise a specific response time.
Last reviewed: November 1, 2026.
See also Privacy Policy and Support.