NOTIFICATION was merged into BACKEND on 10-08-2026 and WEBSITE was removed the same day. Neither is deployed, so neither receives security updates. Report anything affecting the notification or email surface against BACKEND, which now owns it.

We take security seriously at Studzee. If you discover a security vulnerability, please report it responsibly.

1. Do NOT create a public GitHub issue for security vulnerabilities
2. Email your findings to the project maintainers directly
3. Include detailed steps to reproduce the vulnerability
4. Provide any relevant proof-of-concept code

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if available)

The following are in scope for security reports:

• Authentication and authorization flaws
• Data exposure vulnerabilities
• Injection attacks (SQL, NoSQL, Command injection)
• Cross-site scripting (XSS)
• Cross-site request forgery (CSRF)
• Server-side request forgery (SSRF)
• API security issues
• Sensitive data in logs or error messages

• Social engineering attacks
• Physical attacks
• Denial of service attacks
• Issues in third-party dependencies (report to the respective maintainers)
• Vulnerabilities requiring physical access to a user's device

• Never commit secrets, API keys, or credentials
• Use environment variables for sensitive configuration
• Follow the principle of least privilege
• Keep dependencies up to date
• Run security linters before submitting PRs

• All protected endpoints use Clerk for enterprise-grade authentication
• JWT tokens are validated on every request
• Role-based access control is enforced for admin operations

• All data in transit is encrypted via HTTPS
• Sensitive data is never logged
• User credentials are managed by Clerk (not stored locally)

We appreciate the security research community's efforts in helping keep Studzee secure. Reporters of valid vulnerabilities will be acknowledged (with permission) in our security acknowledgments.