Security

Security summary

This page describes current controls and known gaps. It does not claim a certification or independent security audit.

Current controls

• Cloudflare Pages serves the public static application over HTTPS at the custom domain.
• Google Firebase supplies optional email-and-password authentication, Firestore and callable backend services.
• Firestore rules scope student-readable data to the authenticated owner and keep private answer-key material server-side.
• OpenAI credentials are held as server secrets; the production build checks that private keys and marking material are not bundled into browser assets.
• The browser requests reCAPTCHA Enterprise App Check tokens and callable Functions enforce valid App Check tokens in production.
• Response headers include MIME sniffing protection, frame denial, a restrictive referrer policy, limited browser permissions and a Content Security Policy.

Known beta gaps

Managed-school compatibility and App Check valid/invalid request metrics still require testing before launch. Emulator mode is local-only. A fixed retention schedule, public security-incident contact and independent penetration test have not been established.

Reporting a concern

Do not include passwords, API keys or student answers in a security report. A verified security contact must be published before wider release.