Security

How accounts, answers and payments are protected — and how to report a vulnerability.

Accounts

Passwords are stored hashed with bcrypt — we cannot read yours, and a copy of our database would not reveal it. Sessions use signed tokens in an HTTP-only cookie, which means a script on a page cannot steal one. A password reset link is valid for one hour and once only.

In transit

Everything runs over HTTPS, with HSTS set so a browser refuses to fall back to an unencrypted connection. Live rooms use a server-sent event stream over the same connection.

In the application

Every page is served under a content security policy that refuses scripts we did not put there. Anything written in a rich text editor — quiz questions, blog posts, policy pages like this one — is sanitised when it is saved and again when it is displayed. Database access goes through parameterised queries. Sign-in, password reset, contact and payment endpoints are rate limited.

Payments

We never see your card. Payments go directly to PayU or PayPal, who handle the card details; what comes back to us is a reference and a result. Gateway credentials in our own settings are encrypted with AES-256-GCM before they are stored, and are never sent back to a browser.

What we do not claim

We are a small team, not a bank. We do not hold ISO 27001 or SOC 2 certification, and we would rather say so than imply otherwise. If your institution needs a formal security review before adopting a tool, write to us and we will answer honestly about what we do and do not have.

Reporting a vulnerability

If you have found something, please tell us before you tell anyone else: security@eduquizzy.com. Include enough detail to reproduce it. We will confirm within 2 working days and keep you informed until it is fixed. We will not pursue anyone who reports a genuine issue in good faith and does not access other people's data, degrade the service, or hold the finding to ransom.