Vulnerability Disclosure Policy

Found a security issue in GymMaster? Please tell us by emailing security@gymmaster.com.

Include the affected URL or feature, steps to reproduce, and the impact. A proof of concept helps.

Scope

In scope: *.gymmasteronline.com, *.serenitybookings.com, the GymMaster member & staff apps, GymMaster managed services, and our APIs.

Out of scope: third-party services (eg billing providers), www.gymmaster.com.

Rules

Only test against your own account. Never access, modify or keep other people's data. If you come across personal data, stop, report it, and delete any copies.
No denial of service, load testing, or high-volume automated scanning.
No social engineering or phishing of our staff, clients, or their members.
No physical testing, and never trigger door or access control hardware at a real facility.
Give us reasonable time to fix the issue before disclosing it publicly. We suggest 90 days, or sooner once a fix is released.

Safe Harbour

If you act in good faith and follow these rules, we won't take legal action against you, and we'll treat your research as authorised.

What to Expect

We'll acknowledge your report within 5 business days, keep you updated, and let you know when it's fixed. We don't operate a formal bug bounty, but are happy to discuss compensation depending on the discovery.

Not Accepted

Unless there's a demonstrated impact: missing security headers, SPF/DKIM/DMARC settings, clickjacking on non-sensitive pages, self-XSS, version disclosure, and unverified automated scanner output.

Last updated: October 2026