Security
Last updated: 31 October 2026
If you find a weakness in Perdura that could expose someone's data or account, we want to hear about it. This page says how to tell us, what is in scope, and what we promise in return.
How to report
Write to support@perdura.fit with "Security" in the subject, in English or Spanish. Say what you found, the page or address, the steps to see it again, and what someone could do with it. Leave other people's data out: if you saw some, say that you did, not what it was.
What we do
- We reply within 5 business days to say we have your report, and keep you told as we work on it.
- We tell you when it is fixed, and agree with you when you may write about it.
- Perdura cannot pay rewards for reports.
In scope
perdura.fit and www.perdura.fit: the public pages, the signed-in pages and the API under /api.
Out of scope: the services Perdura uses, such as Google sign-in, Polar's checkout, Anthropic, Neon, Vercel and Resend (report a problem in one of them to the company that runs it), findings that need someone else's unlocked device, and scanner output with no shown effect.
Rules for testing
- Test only with accounts you created yourself. Never read, change or delete another member's data. If you reach some by accident, stop there, keep none of it, and tell us.
- Leave Perdura working for everyone else: no denial of service, no load testing, and no scans that send a flood of requests.
- No phishing or other tricks on members or on us, and no physical access to anyone's devices.
- Go no further than you need to show the problem, and give us time to fix it before telling anyone else.
Safe harbour
If you follow these rules in good faith, we treat your research as authorised. We will not take legal action against you or report you to the police for it, and if someone else does, we will say that you acted under this policy. It covers Perdura only, not the services named as out of scope.
The same contact is in Perdura's security.txt. For what Perdura promises its members, see Trust.