Security & Reporting

Last updated July 8, 2026

How we protect your data

• All traffic is encrypted in transit (HTTPS).
• Row-level security in the database restricts every record to the people who should see it — private messages to their participants, submissions to their owner and graders, quiz answer keys to the server only.
• Admin capabilities require officer roles enforced on the server, not just hidden in the interface.
• Sign-in attempts and other sensitive endpoints are rate-limited to slow abuse.
• The app sends strict security headers, including a Content Security Policy, to browsers.
• Sensitive admin actions (role changes, grading, point adjustments, deletions) are logged.
• Errors are monitored so we can detect and fix problems quickly; those reports exclude message and file contents.
• Passwords are managed by Supabase Auth; the organization never sees or stores them.

Reporting a vulnerability

If you find a security issue in the portal, please email contact@example.com with enough detail to reproduce it. Give us a reasonable window to fix it before sharing publicly. We will not pursue action against good-faith security research that respects member privacy and avoids service disruption.

If something goes wrong

Suspected account compromise, exposed data, or abuse: contact contact@example.com immediately. The officer team will investigate, revoke affected access, and notify impacted members.