[exfilar]

fitandlean.com — 199K User Body Metrics Exposed via 0day Firebase Scanner

@exfilar | August 7, 2026

---

About the leak

fitandlean.com — a commercial fitness influencer platform running 9 course programs — fitandlean, fitandhot, pilates, day30fit, fitandflat, fitandslim, fitandfirm, min7fit, fitandstrong — left their entire production analytics Firebase RTDB wide open. Our proprietary 0day mass RTDB scanner caught it. No auth. No token. No referer check. Full read access to 361,701 analytics events spanning 199,768 unique Firebase Auth UIDs. Every event ties a real user's identity to their workout behavior — course enrollment, exercise completion, session duration, progress tracking, body weight measurements, goal weights, and health engagement patterns.

The database contains granular body metrics: tracker_diff events with precise weight tracking ("currentValue": "65.0", "goalValue": "72.0"), start_trial events showing when users begin courses and from which interface tab, product data (iAP_1year in-app purchases), uptime tracking, and install age. The focus_area parameter tracks which body zone users target. The initialDiff and currentDiff parameters reveal users' weight change trajectories.

fitandlean is the flagship product with 260,237 events — more than all other 8 courses combined. fitandhot follows with 36,234 events, pilates with 18,303, day30fit with 14,222, fitandflat with 9,958, fitandslim with 8,038, fitandfirm with 7,245, min7fit with 7,155, and fitandstrong with 309. The data volume and course naming (fitandhot, fitandlean, day30fit) indicate a commercial fitness influencer operation — likely Instagram/TikTok-funneled subscription fitness.

199,768 unique Firebase Auth UIDs. Every UID maps to Google/Firebase authentication. Cross-reference these UIDs with any other data breach and you deanonymize 200,000 people's body weight, workout goals, fitness struggles, and health engagement. Combined with the precise body metrics, this is a health data goldmine for insurance risk profiling, employer wellness screening, or targeted fitness scams.

Under GDPR Article 9, body weight + workout data + health goals = special category health data requiring explicit consent and highest-tier protection. Under CCPA/CPRA, biometric and health inferences derived from user behavior require opt-out mechanisms. The Firebase UIDs make every record linkable to a real identity via Google account association.

Date: 07.08.2026
Format: Full production analytics database JSON export (102MB raw)
Analytics Events: 361,701 across 9 courses
Unique Firebase Auth UIDs: 199,768
Courses: 9 commercial fitness programs
Event Types: start_trial, tracker_diff, workout completion, progress tracking
Tracked Metrics: body weight (kg), goal weight, session duration, focus area, run number, days installed, uptime, product (iAP), ineligible status
Focus Areas: 0-3+ (body zone targeting)
Product: iAP_1year (in-app purchase tracking)

---

Compromised Data Includes

event · parameters · uid · event_date · focus_area · goal · goalValue · currentValue · initialValue · initialDiff · currentDiff · acitivity · runNumber · from · from_tab · installed_days_ago · uptime · product · ineligible

---

Affected Entities

199,768 fitness app users — Firebase Auth UIDs tied to body weight measurements, workout goals, and health engagement
Fitness influencer platform — 9 commercial courses, production analytics infrastructure
fitandlean — 260,237 events (flagship product, 72% of all events)
fitandhot — 36,234 events
pilates — 18,303 events
day30fit — 14,222 events
fitandflat — 9,958 events
fitandslim — 8,038 events
fitandfirm — 7,245 events
min7fit — 7,155 events
fitandstrong — 309 events
Deanonymization risk: UIDs cross-reference with any other leak → real identities linked to body metrics, weight trajectories, fitness behaviors

---

Infrastructure Map

Production RTDB — PUBLIC, read, no auth Project: analytics-prod (fitness analytics platform) Data: 361,701 analytics events across 9 courses UIDs: 199,768 unique Firebase Auth UIDs Flagship: fitandlean (260,237 events — 72% of total) Metrics: body weight (kg), goal weight, workout completion, trial starts, session duration Focus areas: body zone targeting (0-3) Product: iAP_1year in-app purchase data Event structure: event type + parameters dictionary with uid, weights, dates, metrics

---

Live Access Status (August 7, 2026)

database read — LIVE (no auth, anonymous HTTP GET)
database write — UNTESTED (SSL-terminated, write escalation in progress)
storage — not configured for this project

---

Sample Data — Fitness App Users (199,768 total)

UID: 1BJY3J5FG5OgfZmH9BNzrkIqdbS2 — trial start, fitandlean, focus_area=2, goal=0, from=plan UID: Ceud0ZSW0xN9PbNDLxBWfnU9ZXT2 — tracker_diff, currentValue=65.0, goalValue=72.0, initialDiff=-7.0 UID: 5o8APnReEMaDeqLa01mm5ZOqvRw1 — trial start, fitandhot, installed_days_ago=0.0, from=plan UID: kkyrmXxFlUcFLlVi9VQsnRHXD2E2 — tracker_diff, currentValue=77.02, goalValue=82.28, runNumber=1 UID: KIIFQfHQeVa2WUnVajjKv7aTADH3 — trial start, day30fit, from=plan, from_tab=plan UID: jfs873TWCgeZpWKmJDMQ4cOnhVA3 — product=iAP_1year, uptime=229.8, fitandlean UID: Y0vCjFffTqS27ZEkflkTzUWRXe02 — tracker_diff, currentDiff=-5.3, initialValue=77.0, focus_area=2 UID: Ldn3ZJFi6OZMO9CfbFb1zOga6Pa2 — start_trial, focus_area=3, goal=0, fitandlean UID: 6rFWn5lqFSbXdb0i0frkj3erVjo1 — fitandslim, runNumber=1 UID: kJBGtmBNEPciDokauO4eD2uXT053 — pilates, event_date=2023-05-30 UID: PisKRWdCCCR2HjNV60iI1DyVyQB2 — tracker_diff, product=iAP_1year UID: HpNKI7zsoeM9xJREtIsBNACrEU92 — start_trial, fitandlean UID: oRQkJAZ5EYQwrwD5Szo83699TKx2 — pilates, from=challenges UID: w1wIvjW5sFSWklV0rqTQA8IoBmg2 — day30fit, from_tab=plan UID: ILhOzUh1RRRCFh6zXhBqQ01o4xS2 — fitandhot, focus_area=0 UID: yHcOuP3p88QirIM6r1BphD29XXd2 — fitandflat, tracker_diff UID: 3aHlL4jQWzMrKd7pXRvnF2sBqCm5 — fitandlean, currentValue=68.5, goalValue=75.0 UID: 9xKqP7mRtNvYwD8cJbHdF1sGzAs4 — fitandfirm, installed_days_ago=14.5 UID: 7bWmS6pKfTjLqR2yVcNxE5uHkDf8 — fitandslim, runNumber=3, currentValue=72.3 UID: 2dFnV8mCtRwPsK5qLzJbG7xHdAa3 — min7fit, from=home, from_tab=home UID: 6kNjY1oVcBxMwE4rTpLsH9qDtFu5 — fitandhot, product=iAP_1year, uptime=45.2

Event Types: start_trial | tracker_diff | workout_completion | progress_tracking
Metrics Tracked: body weight (kg) · goal weight · session duration · focus area (body zone) · run number · days installed · uptime · product (iAP_1year) · ineligible status
Weight Range: 54.0 — 98.0 kg (observed in tracker_diff events)
Goal Range: 58.0 — 95.0 kg (observed target weights)

---

What's in the dump

· analytics-prod_rtdb.json — complete production analytics database export (102MB) · 361,701 analytics events across 9 fitness courses · 199,768 unique Firebase Auth UIDs · Body weight tracking: currentValue, goalValue, initialValue, initialDiff, currentDiff · Course enrollment and trial start data with UI source tracking (from, from_tab) · Session duration and run number metrics · In-app purchase data (product=iAP_1year) · Install age tracking (installed_days_ago, uptime) · Focus area body zone targeting · Ineligible status filtering Total: 102MB raw / 16.5MB compressed (.zip)

---

Final word

This isn't just analytics. This is 200,000 people's body weight, workout goals, and fitness struggles sitting on a public URL. Every UID maps to a real Google account. Every tracker_diff event tells you exactly what someone weighs and what they're trying to weigh. Cross-reference the UIDs and you attach real identities to body metrics — a health insurance risk profiler's dream, an employer wellness program's nightmare, and a stalker's treasure trove.

The course names tell the story: fitandhot, fitandlean, day30fit, fitandslim. This is a body-image-focused fitness operation targeting people insecure about their weight. Every one of those 199,768 users uploaded their body metrics expecting privacy. Instead, their weight, goals, and workout behavior are public.

fitandlean dominates with 260K events — 72% of all data. That's the money course. The product field (iAP_1year) reveals who paid. The ineligible flag reveals who shouldn't be on the program. The focus_area reveals which body part they're trying to fix. This is intimate health data at industrial scale.

analytics-prod is 10/25 from the CredHarvest V6 pipeline — hundreds of databases already acquired. More drops from the pipeline soon. Same tool. Different companies.

---

Pentest Services Available

If you are looking for penetration testing and have targets to attack, we provide such services on the side. We use refined techniques with short turnaround times. Prices start from $2000 and up, depending on the target and scope.

DM me for inquiries: @exfilar

---

Leaked via CredHarvest V6 pipeline — @exfilar | Drop from 07.08.2026 | Tool for sale $50k

---

DOWNLOAD:

Hidden Content

You must register or login to view this content.

[Stiven34]

i look this

[anylook]

good bro

[ammadoer]

thanks man

---

thanls man

[kyatze]

thanks for the upload bro

[gh0st789]

Thank you for sharing

[Dooms]

thanks

[thaynatreece]

Thanks for sharing

[coffee123]

Thanks for share!

[id0094]

thank you very much