Cultfit Vulnerability Disclosure

generated: '2026-08-10'
method: searched
probe: true
source: https://www.cult.fit/security
policy:
- https://www.cult.fit/security
contact:
- security@cult.fit
program:
  type: bug-bounty
  self_hosted: true
  platform: none
  reward_tiers: [Gold, Silver, Bronze, Thanks]
  reward_basis: >-
    Discretionary, based on the severity and impact of the reported issue.
  in_scope:
  - '*.cult.fit'
  - '*.curefit.co'
  - '*.cultsport.com'
  - '*.curefit.com'
  out_of_scope_examples:
  - self-XSS
  - denial of service
  - phishing / social engineering
  - software version disclosure
  - CSRF on login endpoints
  - missing security headers
  - CORS misconfiguration with no demonstrated exploit path
  - outdated libraries with no working exploit
  reporting_steps:
  - Identify the vulnerability impact and severity
  - Recreate the scenario
  - Share screenshots or video of the issue
  - Provide contact details for follow-up
  coordinated_disclosure: >-
    Reporters are asked not to discuss or disclose vulnerability details until the
    report is closed. Cult.fit reserves legal recourse if a reported vulnerability
    is exploited for unlawful gain — the policy is not a full safe-harbor grant.
security_txt:
  served: false
  note: >-
    /.well-known/security.txt returns 404 on every Cult.fit, Cure.fit and
    Cultsport host probed. The disclosure program is human-readable only; a
    machine cannot discover the reporting channel from the well-known path.
evidence:
- source: https://www.cult.fit/security
  status: 200
  kind: disclosure page
  keywords:
  - vulnerability
  - bug bounty
  - responsible disclosure
  - security@cult.fit
  - ethical hackers
- source: https://www.cult.fit/.well-known/security.txt
  status: 404
  kind: RFC 9116 probe
x-evidence:
  fetched: '2026-08-10'
  url: https://www.cult.fit/security
  http_status: 200