Security and vulnerability disclosure

Reporting something

Email security@superheatprep.com. Include what you found, where, and enough detail to reproduce it. A proof of concept helps; a video is fine; a scanner report on its own usually is not.

Please do not open a public issue, post it, or demonstrate it against other people’s data before we have had a chance to fix it.

This page is the policy referenced by /.well-known/security.txt, which is served in the machine-readable form RFC 9116 describes.

Scope

• The Superheat mobile app on iOS and Android.
• This website and the instructor console on the same origin.
• The cohort endpoints: code redemption, the progress ping, content updates, defect reports.
• The Stripe webhook handler and seat issuance.
• Anything that would expose one instructor’s roster to another.

Safe harbour

If you make a good-faith effort to follow this page, we will not pursue or support legal action against you for your research, and we will treat it as authorised access. Good faith means: work only against your own data or accounts we have given you, do not degrade the service for other people, do not access, modify, keep or publish anybody else’s data, stop as soon as you have demonstrated the issue, and give us reasonable time to fix it before disclosing.

If a third party’s terms are involved — Apple, Google, Stripe, Supabase — we cannot waive those on their behalf.

Out of scope

• Denial of service, volumetric testing, and anything that degrades the service for others.
• Social engineering of staff, students or instructors, and physical attacks.
• Reports that a security header is missing, without a demonstrated impact.
• Vulnerabilities requiring a rooted or jailbroken device and physical possession of it.
• Extraction of the question bank from the app binary. It ships on the device by design because the app works offline; treat it as public and tell us if you find something more interesting behind it.
• Automated scanner output with no analysis attached.

How the product limits the damage

The most reliable way to survive a breach is not to hold the data. Most of the decisions below were made for that reason rather than for privacy alone.

• No individual accounts, no passwords, no student email addresses. There is no credential database to steal and no address list to leak, and the schema has nowhere to put a student’s email address even if someone tried to add one.
• Answer history never leaves the device. There is no server table that could hold it, so no server compromise can expose it.
• Three tables are unreadable by any client role. Seats, progress pings and defect reports have row-level security enabled with no policies at all and no grants. They are reachable only through specific functions that validate the caller. A leaked public API key is not a route to a roster.
• Instructor isolation is enforced in the database. Cross-tenant access is blocked by policy, not by an application check, and there is a test that signs in as one instructor and asserts another’s cohort is invisible.
• The ping endpoint rejects unknown fields. A request carrying a fifth field is a 400 — not ignored, not stripped and stored. A client build that started attaching answer detail would fail loudly on its first request.
• Instructor sign-in is a one-time link. No password to reuse, phish or stuff. The session cookie is signed and HTTP-only.
• Stripe webhooks are signature-verified with a constant-time comparison and a timestamp tolerance, and fulfilment is idempotent on two independent keys, so a replayed event cannot issue a second cohort.
• Seat codes are eight characters from a 32-symbol alphabet with no O, 0, I or 1, are rate-limited on redemption, and bind to one device hash on first use.
• No secrets in the repository. An example environment file is committed; real values never are.

Transport and headers

Everything is served over HTTPS with HSTS. The site sends a content security policy that permits scripts, styles, fonts and images only from its own origin — there is no CDN script, no tag manager and no third-party font — along with nosniff, a frame-ancestors restriction, a referrer policy, and a permissions policy that switches off camera, microphone, geolocation and payment.

The public pages set no cookies at all. The only cookie the origin ever sets is the instructor session, and it is signed, HTTP-only and same-site.

If something happens

If a breach affects data about a person, we will say so: what happened, what was affected, when, and what we did. For an individual technician the honest answer is likely to be that nothing about them could have been affected, because we hold nothing about them — and if that stops being true, that is exactly when we would need to tell you.

Privacy policy · Retention schedule