Security

We protect Syntaxia with role-based access, encrypted transport, and least-privilege service credentials. Student submissions and grades are scoped so learners cannot read each other's private work.

Practices

• HTTPS everywhere.
• Supabase row-level security for multi-tenant chapter data.
• Service-role keys never shipped to the browser.
• Rate limits on authentication, invitations, and future code execution.
• Isolated runners planned for student code (network disabled, time/memory limits).

Report a vulnerability

Email founders@syntaxia.org with details. Please do not publicly disclose before we can remediate.