Skip to main content
Tides Pilates
HomeBookPricing & PlansGalleryContact
LoginSign Up

Tides Pilates

Classical Pilates in Arcata, CA. Private, duet, and small group sessions for all levels.

Explore

  • Book
  • Pricing & Plans
  • Gallery
  • Contact

Account

  • Sign In
  • Create Account

© 2026 Tides Pilates. All rights reserved.

Privacy PolicyTermsSecurity
Responsible disclosure

Help us keep Tides safe.

If you believe you found a security issue in the Tides Pilates platform, report it privately. We will investigate carefully, protect reporter confidentiality, and share material fixes when public disclosure is useful.

Report a security issuesecurity@mail.tidespilates.com

Practical response target

We aim to acknowledge contactable reports within two business days.

Safe harbor

Good-faith, bounded research following this policy will not be treated as an attack.

No bounty program

We do not promise payment, but we value clear, responsible reports.

Testing boundaries

This policy covers the Tides-owned web application and supporting APIs. It does not grant permission to test Clerk, Stripe, Resend, Twilio, Convex, Vercel, or other providers outside their policies.

Good-faith research

  • Test only accounts and data you own or have explicit permission to use.
  • Stop immediately if you encounter another person’s private, health, payment, or account data.
  • Use the minimum testing needed to demonstrate the issue, then report it privately.
  • Give us a reasonable opportunity to investigate and remediate before sharing details publicly.

Not authorized

  • Denial of service, spam, resource exhaustion, or disruption of studio operations.
  • Social engineering, phishing, employee targeting, or physical-security testing.
  • Persistence, malware, destructive payloads, credential theft, or data exfiltration.
  • Testing third-party services outside the provider’s own security policy.

Published advisories

We publish selected material findings after remediation. Routine hardening and low-risk maintenance may remain in internal records.

TIDES-2026-002critical

Account linking accepted untrusted email claims

From March 18 through June 15, 2026, some legacy and pre-created account-linking paths could rely on a caller-controlled or insufficiently assured email claim. Tides corrected every linking branch and now accepts ownership only from trusted Clerk identity or webhook data.

TIDES-2026-003high

Private file URLs lacked per-file authorization

From March 18 through April 21, 2026, an authenticated file-serving API verified sign-in but did not independently authorize each requested private storage object.

TIDES-2026-004
What to include
A concise, reproducible report helps us act quickly.
  • The affected page, API, or workflow.
  • Exact steps needed to reproduce the behavior.
  • What you expected and what happened instead.
  • The security or customer impact you believe is possible.
  • Screenshots or evidence that avoid exposing another person's data.
Open the private report form
critical

Unauthenticated diagnostic query exposed client account data

From March 18 through June 14, 2026, a diagnostic API could return a client profile and related membership, package, and booking information when supplied with that client's email address, without requiring authentication.

TIDES-2026-005high

Authenticated clients could read other clients' roster details

From March 18 through June 14, 2026, two staff-oriented schedule APIs required sign-in but did not require a staff role before returning enriched class-roster data.

TIDES-2026-006high

Next.js Server Action requests could cause denial of service

Until July 23, 2026, Tides used a Next.js version affected by CVE-2026-64641, in which crafted requests to an App Router application using Server Actions could cause excessive CPU use and temporarily reduce availability.

TIDES-2026-001medium

Intake accepted an untrusted return destination

From March 18 through July 10, 2026, the authenticated client intake flow accepted an unvalidated return destination and passed it to client-side navigation after intake completion. A crafted link could cause unintended navigation or, for an unsafe URL scheme, script execution in the page context. Tides found no evidence of exploitation, affected accounts, or customer impact.