Legal

Security

Last updated 15 September 2026

The safest data is the data we never collect, and this platform collects very little. Passwords are hashed and unreadable to us, learning records are protected at the database level, and your code never leaves your browser. If you find a vulnerability, tell us and we will not come after you for it.

Security Practices

The strongest security measure on this platform is how little it holds. There is no payment data, no addresses, no phone numbers, no documents, no analytics profile and no record of anything you write. A breach cannot expose what was never collected.

Beyond that:

  • Everything is served over HTTPS.
  • Passwords are hashed by our authentication provider. We never store them, and we never see them in readable form. Nobody here can look up your password, including us.
  • Access to learning records is enforced at the database level by row level security, so one learner's row cannot be read by another even if the application layer had a bug. The rule is enforced by the database rather than trusted to the code in front of it.
  • The payment secret key exists only on the server and never reaches the browser. That is why contributions start through a server route rather than in the page.
  • Your code runs inside your own browser. The React preview runs in a sandboxed frame on an opaque origin, so it cannot reach your session or your stored progress.
  • Public keys that appear in the browser are designed to be public and are constrained by the database policies behind them.

This is a platform built and maintained by one person. It has not had an external penetration test, and saying so is more useful to you than implying otherwise.

What We Deliberately Do Not Store

Some of this is worth stating as a security property rather than only as a privacy one, because it changes what an attacker could ever obtain.

  • No card numbers, bank details or billing addresses. Stripe handles payments on its own pages and we never receive them.
  • No code you write. Exercises and projects run in your browser and are never transmitted to us.
  • No analytics, session recordings, heatmaps or advertising identifiers. There is no behavioural profile to steal.
  • No phone numbers, home addresses, dates of birth or identity documents. We never ask for them.
  • No teacher notes. Those stay in the teacher's own browser.

Responsible Disclosure

If you find a vulnerability, please tell us before telling anyone else, and give us a reasonable chance to fix it.

You are welcome to test against your own account. Please do not access, modify or delete data belonging to anyone else, degrade the service for learners, run automated scanners that generate heavy traffic, or attempt social engineering against anyone.

We will not pursue legal action against anyone acting in good faith within those limits. There is no bug bounty programme, because there is no budget for one. What we can offer is a prompt reply from the person who wrote the code, credit on this page if you want it, and a fix.

Report a vulnerability, not a scan result. A report that explains what an attacker could actually do is worth far more than a tool's output.

What to Include

Enough for us to reproduce it, which usually means:

  • What the issue is and what an attacker could do with it.
  • The exact steps to reproduce, including the page address.
  • What you would expect to happen instead.
  • Any proof of concept, kept to the minimum needed to demonstrate it.

We aim to acknowledge reports within three working days. Anything that exposes learner data is treated as the highest priority and worked on immediately.

If a vulnerability ever did expose learner information, we would say what happened, what was affected and what to do about it, promptly and in plain language. That commitment is in the Privacy Policy too.

Security Contact

Email hello@sankofacode.org with “Security” in the subject line. It is read by one person and moves to the front of the queue.

If the issue is sensitive and you would prefer an encrypted channel, say so in a first message without the details and we will arrange one.

For a privacy question rather than a vulnerability, see the Privacy Policy. For an accessibility barrier, see the Accessibility page.

Questions about this policy go to hello@sankofacode.org. Every message gets a personal reply.

All policies