Responsible Disclosure Policy

Email info@mywiseboardclassroom.com with:

• A description of the issue and its potential impact.
• The exact URL or component affected.
• Step-by-step reproduction (minimal proof-of-concept).
• Your contact info and (optionally) how you'd like to be credited.

Mark anything sensitive with the subject prefix [SECURITY]. We'll respond within 2 business days with a tracking ID.

• We will not pursue or support legal action against researchers acting in good faith and within this policy.
• We will acknowledge your report within 2 business days and provide a triage decision within 5 business days.
• We will keep you informed as we remediate.
• We will credit you in our hall of fame (below) unless you ask to remain anonymous.
• We may offer a discretionary bounty for high-impact, novel issues. We do not run a paid bug-bounty program at this time.

• mywiseboardclassroom.com and any subdomain
• The WiseBoard mobile app (iOS / Android)
• The WiseBoard public API
• Authentication and session management
• Authorization (e.g. cross-tenant access, IDOR, privilege escalation)
• Server-side data-handling bugs (SQLi, SSRF, XXE, etc.)
• Persistent or stored XSS
• Logic flaws affecting student-data privacy or billing

• Denial-of-service or load-testing ; please don't.
• Automated scanner output without a working proof-of-concept.
• Reports on outdated browsers (anything > 2 versions behind current).
• Missing security headers without a demonstrated impact.
• Email best-practice misconfigurations (DMARC posture is published; we welcome guidance but it's not a vulnerability).
• Social-engineering attempts against staff, customers, or vendors.
• Physical attacks on infrastructure.
• Vulnerabilities requiring physical access to a victim's unlocked device.
• Issues in third-party services (OpenAI, Stripe, Replit, Resend) ; please report directly to the vendor.

• Use a test account you control. Do not access, modify, or delete other customers' data.
• Stop the moment you confirm a vulnerability and report it. Do not exfiltrate beyond the minimum needed to demonstrate the issue.
• Do not publicly disclose the issue until we've had a reasonable opportunity to fix it (typically 90 days from triage; we'll coordinate timelines).
• Comply with all applicable laws.

Researchers who have helped make WiseBoard safer for students and educators. Want to be on this list? See above.

No reports have been received yet. Yours could be the first.

We publish /.well-known/security.txt per RFC 9116. Automated security scanners and aggregators will find us there.