Security policy

Email security@edubyte.tech with a description, reproduction steps and impact. Do not include real learner data, credentials or private keys. Please give us a reasonable window to investigate before public disclosure.

Good-faith research on EduByte-owned systems is welcome. Do not test against other learners’ accounts, attempt denial of service, use social engineering, or access data that is not yours. We will not pursue legal action for good-faith research that follows these rules, but this statement is not a waiver of any third-party rights.

Security is layered across the platform:

• TLS in production, security headers on every response and rate limiting on verification and authentication.
• Managed authentication with secure session cookies and email verification.
• Deny-by-default row-level security, server-side policy checks and audit records for credential issuance and status changes.
• Sandboxed, origin-isolated code preview with no access to application storage.
• Issuer-controlled credential records with service-only writes, revocation history and append-only audit records.
• Dependency review, protected deployment secrets and least-privilege service credentials.

Issuance is server-authorized. Learners cannot create a credential by editing a page. Each credential has a random public identifier, an issuer-controlled record and a timestamped status history. Revocation requires a documented reason and is audited. Public verification never reports a credential as valid when the status service is unavailable.

We do not claim that fraud is impossible or that the platform is “hacker-proof”. We design to make unauthorized issuance detectable, tampering evident and status changes visible. Identity assurance is stated explicitly on credentials where it applies.

We maintain an incident response runbook with severity levels, an on-call owner and playbooks for credential key compromise, data exposure and service outage. If a key compromise affects issued credentials, we will rotate keys, publish new verification keys and communicate a reissuance plan.

Security: security@edubyte.tech. Credential operations: verify@edubyte.tech.