Security

Saturday holds athletes' training and health data and runs AI that gives fueling advice. This page covers who is responsible for keeping both safe, how we do it, and how to report a problem.

Who leads security

Dr. Alex Harrison, founder of Saturday, leads product, engineering and security. He is responsible for the security of the Saturday app, the coach platform, the Saturday API and Saturday's AI, including:

  • Prompt-injection hardening on every path where Saturday's AI reads text from athletes, coaches, partners or other AI systems.
  • Security of AI-to-AI communication through the Saturday API, where partner AI systems talk to Saturday's AI.
  • Saturday's MCP server, which lets AI assistants such as Claude read and act on Saturday data.

Outside Saturday, Alex hunts vulnerabilities as an independent security researcher on Intigriti and Immunefi.

How we protect Saturday's AI

  • Text from outside Saturday is untrusted. Messages from athletes and coaches and requests from partner AI systems pass through one shared input sanitizer before a model reads them.
  • Every AI response is checked for unsafe fluid and sodium advice before it reaches an athlete, including while it streams.
  • AI assistants connected through MCP sign in with OAuth 2.0, with PKCE required, and see only the athlete or coach who signed in.
  • Partner AI systems use partner-scoped keys, and each partner's data is isolated from every other partner's.
  • We run adversarial tests against our API and AI, covering web vulnerabilities, prompt injection between AI systems, infrastructure, and unsafe fueling advice.

How we build

  • An automated security reviewer reads every change to our code.
  • Dependencies are scanned daily for known vulnerabilities, and our repositories are scanned for leaked secrets.
  • Data is encrypted in transit and at rest on Google Cloud.
  • Card payments are processed by Stripe, Apple and Google. Saturday never receives or stores full card numbers.

Report a vulnerability

Email security@saturday.fit with the affected URL or endpoint, steps to reproduce, and the impact you observed.

Test only against accounts and data you control, and give us reasonable time to fix an issue before you disclose it.

Our security.txt is at saturday.fit/.well-known/security.txt.