Please report security vulnerabilities privately via GitHub: Report a vulnerability

Do not open a public issue for security concerns.

• app.html / js/app.js / js/workouts.js — client-side app logic
• cloudflare/worker.js — the optional hosting gate One-time password (OTP) auth, session management)

Out of scope: Cloudflare infrastructure, Resend email delivery, GitHub itself.

• Description of the vulnerability and potential impact
• Steps to reproduce
• Any proof-of-concept (screenshots, request/response, or other relevant information.)

I aim to acknowledge reports within 72 hours and resolve valid findings within 30 days.