Security

Found a security issue? Please email studyedurank@gmail.com with steps to reproduce. Give us a reasonable chance to fix it before disclosing it publicly. We will not pursue legal action against researchers who act in good faith and do not access, modify or exfiltrate other people’s data.

Passwords are stored as salted PBKDF2-SHA256 hashes — never in plain text. Sessions use opaque high-entropy tokens stored only as hashes. All traffic is served over HTTPS. Access to data is limited to what each role needs.

For spam, stolen notes or abusive accounts, use the in-app Report action or email studyedurank@gmail.com.

We do not currently offer a paid bug bounty. We do appreciate responsible disclosure and will credit reporters who ask to be credited.