Current controls
- Clerk authentication with server-side role and resource-ownership checks.
- Teacher-scoped database queries for classrooms, students, assignments, submissions, grades, Google connections, and files.
- Strict request validation, bounded inputs, and HTML removal for user-provided text.
- Encrypted Google OAuth tokens and state validation for the OAuth callback.
- Private file references, teacher-authorized download routes, short-lived access, and PDF/PNG/JPEG size and signature checks.
- Content Security Policy, HSTS, frame denial, MIME sniffing prevention, and strict referrer headers.
- Privacy-filtered Sentry reporting with student work, cookies, request bodies, and session replay excluded.
- Automated tests for authentication, cross-account denial, admin isolation, duplicate grading requests, and data deletion.
Beta limitations
Rate limiting is currently process-local rather than globally distributed. File checks are not a complete malware-scanning service. The beta is intended for invited teachers using non-critical assignments while production controls and operational evidence continue to mature.
Responsible reporting
Report suspected unauthorized access, data exposure, token leakage, or other security issues privately through the contact below. Do not access another user's data, disrupt the service, publish student information, or demand payment. Include the affected URL, time, and safe reproduction steps without attaching student work or credentials.
No certification claim
This overview describes implemented controls. It is not a claim of SOC 2, ISO 27001, penetration-test completion, legal compliance certification, or breach-free operation.