Skip to main content

Bug Bounty

For security researchers. If you have found a vulnerability, or a bug that seriously breaks Achilles for real athletes, report it here and we will work with you on a fix.

You do not need an Achilles account. Reports go to a separate, triaged queue from general support. For everyday problems — a question, a feature request, something mildly broken — contact support instead.

Report an issue

Report type

Prefer email, or have a large attachment? Write to security@achilles.fit. Attachments up to roughly 30 MB are fine; host anything larger and send a link.

Rewards

  • A free month of Achilles Premium.
  • A Bug Hunter badge on your achievements.
  • A place in the Hall of Fame below, with your permission.

Eligibility and severity are at our discretion. Cosmetic glitches, copy typos and low-impact edge cases are welcome, but do not qualify for the reward.

In scope: security vulnerabilities

  • Arbitrary code execution.
  • Injection — NoSQL, or prompt injection that escalates privilege or exfiltrates data.
  • Privilege escalation, from unauthenticated to user or from user to admin.
  • Authentication or authorization bypass, including the admin surface.
  • Circumventing entitlement gating for paid features, on either billing rail — Stripe or Apple In-App Purchase — including forging or replaying an App Store signed transaction.
  • Cross-site scripting or CSRF, except the cases listed as out of scope.
  • Exposure of another athlete's data: training plans, workouts, chat history, GPS traces, connected-provider tokens or profile.

Health and location data is the sensitive category here. A finding that exposes another athlete's workouts or GPS traces is treated as high severity even where the same class of bug would be routine elsewhere.

In scope: high-impact bugs

  • Account-recovery or login dead-ends an athlete cannot get out of.
  • Data loss or corruption of a plan, workout history or logged activity.
  • A core flow broken end to end: plan creation, coach chat, workout logging, checkout or provider sync.
  • Incorrect billing, access or entitlement state — charged wrong, locked out of paid features, or billed on both rails at once.
  • Reproducible crashes that block a whole screen or feature.

Out of scope

  • Denial of service, brute force or volumetric attacks.
  • Social engineering, phishing or physical attacks.
  • SPF, DKIM or DMARC configuration opinions, and mail-system abuse.
  • User or account enumeration.
  • Missing security headers or non-sensitive cookie handling.
  • CSRF on the login, logout or signup pages.
  • Tokens that remain valid after logout or deletion, unless you show an authenticated action succeeding beyond the token's short lifetime. A deleted account is tombstoned server-side, so any token for it is refused.
  • Getting the AI coach to say something off-topic or unhelpful. A guardrail bypass that leaks another athlete's data, escalates privilege or spends model budget without an account is in scope; a jailbreak that only produces undesirable text is not.
  • Missing best practices such as rate limiting or password strength, without a concrete exploit.
  • Architectural trade-offs we have knowingly made.

Hall of Fame

Researchers who reported a valid issue and agreed to be named. We only list someone once they have said yes, using the name they asked for.

No entries yet — the programme is new. Report something valid and you can be the first.

Rules and our commitments

  • Do not access, modify or destroy another athlete's account or data. Test with accounts you own.
  • Do not run attacks that degrade the service for other athletes, and no automated scanners or scrapers.
  • Only test achilles.fit, api.achilles.fit and their subdomains.
  • Give us reasonable time to ship a fix before disclosing publicly.

We respond as quickly as we can, keep you updated toward a fix, and will not pursue legal action against research that follows these rules.