Security
If you have found a vulnerability, we would like to hear about it before anyone else does.
Reporting something
Until the disclosure mailbox on this domain is live, the feedback form at the bottom of every page reaches us and is read within seven days. Choose "Something is broken" and say as little or as much as you are comfortable putting in a form — we will come back to you for detail.
What we will do
- Acknowledge your report and tell you what we think it is.
- Not pursue you for a report made in good faith against your own account or data.
- Credit you if you would like to be credited, and not if you would not.
- Tell you when it is fixed, and say so publicly in the changelog if it affected anyone else.
What we are not offering
There is no bug bounty and no payment. This is a one-person pre-launch product and pretending otherwise would waste your time. Automated scanner output without a demonstrated impact is not something we can act on.
How this is built
- Every table has row-level security, and its policies have tests that run on every change.
- Exam content is never readable by the browser; it is served by server functions that decide what you are entitled to see.
- A nonce-based content security policy, with no inline scripts and no third-party script hosts.
- The database's privileged key never enters the web application's environment. It exists only in server functions.