Security and vulnerability disclosure

How to report

Email security@whizzby.com with:

• what the problem is and where it is (the page, the request or the URL);
• the steps to reproduce it, and what an attacker could do with it;
• any accounts you used, so we can tell your testing apart from real activity;
• whether you'd like to be credited, and under what name.

Please don't put details of an unfixed problem in a public place, such as a public issue, social media or a forum. The same contact details are published in machine-readable form at /.well-known/security.txt.

What happens next

• We'll confirm we have your report within 3 business days.
• We'll tell you whether we can reproduce it, how serious we think it is, and roughly when we expect to fix it.
• We'll let you know when it's fixed, and credit you if you'd like.
• We ask you to give us 90 days from your report, or until it's fixed if that's sooner, before you publish anything about it. If we need longer, we'll explain why and agree a date with you.

Whizzby doesn't run a paid bug bounty. We can't offer money for reports, but we're genuinely grateful for them.

In scope

• The Whizzby website and app at whizzby.com, including its API.
• Anything that lets someone see or change another person's account, uploads, classes or progress.
• Ways around sign-in, two-step sign-in, payments, plan limits or rate limits.
• Cross-site scripting, request forgery, injection and similar flaws in our own code.

Out of scope

• Denial of service, load testing, or anything that degrades the service for others.
• Social engineering, phishing, or physical attacks on our team or our users.
• Spam, or sending many emails or invitations to people who didn't ask for them.
• Services we use but don't run, such as Stripe, Google, Cloudflare, Railway, Resend and OpenAI. Please report those to them.
• Reports from automated scanners, and missing headers or settings, without a way to actually exploit them.

Testing in good faith

If you follow this policy, we won't pursue or support legal action against you for your research. Please:

• test only with accounts you created yourself, and never use a real student's account or data;
• stop as soon as you see someone else's personal data, don't keep or share it, and tell us what you saw;
• not change or delete anything that isn't yours, and not keep access longer than you need to show the problem;
• keep what you find between you and us until it's fixed.

If you're unsure whether something is allowed, email us first and ask. How we handle your personal information is in our privacy policy.