SECURITY
Report concerns privately.
Protect scholars by avoiding public disclosure of credentials, personal data, private assessments, or exploitable vulnerability details.
Reporting
Email security@academyofworlds.com with the affected URL, a concise description, reproduction steps, and impact. Do not access, alter, retain, or share another person's information.
Current safeguards
Email verification, strong password rules, secure recovery, session revocation, origin checks, database-backed rate limiting, scoped founder authorization, server-side answer keys, input validation, encrypted production secrets, security headers, and closed registration are enabled.
Safe testing
Use your own account and data. Stop when you can demonstrate the issue. The Academy does not authorize denial-of-service testing, social engineering, automated credential attacks, persistence, or destructive testing.
Response
Reports will be acknowledged and prioritized according to impact. No bounty or payment program is currently offered.