Security and Responsible Disclosure
StudyRaah XI-XII was earlier called StudyBuddy XI-XII. Only the name has changed: every account, password, plan and record continues exactly as before, and this page applies to them in the same way.
Found a security problem? Please tell us privately at siddharthperti@gmail.com with the subject “StudyRaah security report”. We will reply within 3 working days, fix genuine problems as quickly as we can, and thank you publicly if you wish. Please do not share the problem with anyone else until it has been fixed.
Most of our users are students under 18. Protecting their accounts and information comes first. If you ever see another person's information while testing, stop at once, do not keep a copy, and tell us.
1. How to report
Email siddharthperti@gmail.com and include:
- which page or address is affected;
- the steps needed to see the problem, and what an attacker could do with it;
- screenshots or a short video, if they help;
- how you would like to be named on this page (or that you prefer not to be named).
You can also find these details in our security.txt file.
2. What we promise
- We will acknowledge your report within 3 working days.
- We will keep you informed while we check and fix it. We aim to fix serious problems within 14 days and others within 60 days.
- We will tell you when the fix is live, and you may then describe the problem publicly (we ask for 90 days at most if a fix takes longer).
- With your permission, we will thank you by name in the Hall of Fame below.
3. Safe harbour
If you research and report in good faith and follow the rules in section 4, we will treat your work as authorised. We will not take or support any legal action against you for it, and we will not ask any authority to do so. If someone else raises a complaint about your research, we will make it clear that you acted with our permission.
4. Rules for testing
- Use only accounts you create yourself. Never sign in to, change or delete anyone else’s account, progress or messages.
- Do not download, keep or share any personal information. Prove a problem with the smallest possible example.
- Do not slow down or break the site: no denial-of-service attempts, no flooding, and no heavy automated scanning.
- Do not trick or pressure students, teachers or our team (phishing or social engineering), and do not attempt physical access.
- Do not try to obtain paid content or payments without paying, beyond what is needed to show the problem.
- Give us reasonable time to fix a problem before telling anyone else about it.
5. What is covered
| Covered | Not covered |
|---|---|
| The website studyraah.pages.dev and its chapter pages (and the old address studybuddy-xi-xii.pages.dev, which now forwards to it); the server studybuddy-api.policyatliberty.workers.dev; the AI teacher studybuddy-ai-teacher.policyatliberty.workers.dev. | The demonstration site (demo.studybuddy-xi-xii.pages.dev), which holds only invented data; services run by others (Cloudflare, Google, payment apps); problems that need a stolen phone or computer; reports of a missing header or setting with no practical effect; self-XSS; and attacks that need physical access. |
Especially welcome: ways to sign in as someone else, see or change another student’s information, get around the one-device rule or a test in progress, read paid content without signing in, or upload harmful files.
6. How we protect accounts
- All traffic uses HTTPS. Pages are protected by strict browser security rules that block content from other websites.
- Passwords are scrambled in the browser before they are sent, and then scrambled again with a unique random value before they are stored. Nobody, including us, can read them.
- Professor and admin sign-in codes are stored only in scrambled form, and secret keys are kept in our hosting provider’s encrypted secret store, never in the website’s code.
- Wrong password attempts are limited, an account can be signed in on only one device at a time, and admin actions are recorded in an audit log.
- Every uploaded picture and PDF is checked, and files that hide scripts or programs are refused.
- We run security checks every week and fix what they find. Backups are encrypted.
7. Rewards
StudyRaah is a small education project, so we cannot promise cash rewards at present. Every valid report is thanked publicly (if you agree), and for serious problems we may offer a free StudyRaah Pro plan or a small reward at our discretion.
8. Hall of Fame
We thank the following people for responsibly reporting security problems:
No reports yet. Yours could be the first.
9. Contact
Security reports: siddharthperti@gmail.com. For privacy questions about your own account, please see our Privacy Policy.