How we protect learners
- Encryption in transit. TLS everywhere between the app, the website and our services.
- Secure sessions. Sign-in tokens live in the iOS Keychain and Android Keystore, never in plain storage. Secrets are never shipped inside the app bundle.
- Row-level security. Every table of user data is restricted so you can read and write only your own records.
- Honest assessments. Correct answers are not sent to the device in Test and Assessment mode. Grading happens on the server.
- Two-factor authentication. Offered for email accounts using an authenticator app.
- Rate limiting. Applied on the server, including for the AI Tutor.
- Safe by design. All practical challenges run in simulated, sandboxed content with no live targets, and the AI Tutor refuses to help attack real systems.
- Your data, your control. Export your data and delete your account in the app. See the privacy policy.
Report a vulnerability
We welcome reports from security researchers and from learners who spot something wrong. Please email security@xyberone.com with:
- A description of the issue and where it is (URL, screen or API).
- Steps to reproduce, or a proof of concept that does the minimum needed to show the problem.
- Your contact details, and whether you would like to be credited.
We will acknowledge your report, keep you updated while we investigate and tell you when it is fixed. Our machine-readable contact is published at /.well-known/security.txt.
Scope
In scope: the xyberone.com website, the Xyber One apps and the services they call.
Out of scope:
- Denial-of-service or volumetric testing, and automated scanning that degrades service.
- Social engineering or phishing of our team or users, and physical attacks.
- Third-party services we use, which should be reported to their owners.
- Reports with no demonstrated security impact, such as missing best-practice headers on static pages.
Our commitment to you
If you act in good faith and follow this policy, we will not pursue legal action against you for your research. In return, please:
- Do not access, change or destroy data that is not yours. Stop and report as soon as you can show the issue.
- Do not disrupt the service or other users.
- Give us a reasonable time to fix the issue before you disclose it publicly.
We do not currently run a paid bounty programme, but we are glad to credit you.