Security

Your account

• Passwords are stored only as salted hashes; nobody, including us, can read them.
• New accounts are verified by a one-time email code. Codes are stored hashed, expire after 10 minutes and allow 5 attempts.
• Sign-in, sign-up and code checks are rate-limited to slow down guessing.
• Sessions use secure, HTTP-only cookies.

Your data

• All traffic is encrypted with HTTPS, and the site sits behind Cloudflare's network protection.
• The application server isn't reachable directly from the internet; it only accepts traffic through Cloudflare.
• Your courses are private to your account, and every request checks that you own what you're asking for.
• The database is backed up every night.

Payments

Payments are handled by Stripe, a PCI DSS Level 1 certified payment processor. Card details are entered on Stripe's own pages and never reach our servers.

Reporting a vulnerability

If you find a security issue, email [email protected] with the subject "Security". Please give us a chance to fix it before sharing it publicly. We don't take legal action against good-faith research that avoids harm to users and data. Our contact details are also in security.txt.