Security

The posture

The strongest defence available to a site like this one is having nothing worth stealing, and that is the design rather than a happy accident. Learn Pass Grow is a pre-rendered static site: there is no login, no password, no user database, and no server-side record of anything you type into a calculator. Your grades, your test scores, and your practice-test history are processed in your browser and stay on your device — see the privacy policy for exactly what that means.

The only personal data this site holds anywhere is an email address, and only if somebody typed one into the newsletter form and then clicked a confirmation link. There is no profile attached to it, no payment information behind it, and nothing else to correlate it against. A breach of everything we have would be a list of addresses.

• All pages served over HTTPS, with HSTS preloaded.
• A strict Content Security Policy, plus X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and X-Frame-Options.
• Client-only calculation — nothing entered into a tool is transmitted or stored server-side, and an automated test fails the build if a module starts sending anything.
• No authentication surface at all: no passwords, no sessions, no tokens, no credentials to breach.
• Static hosting on a hardened CDN edge, with no origin server to attack.
• A short dependency list, pinned by lockfile and reviewed when it changes.

One deliberate exception is worth stating rather than leaving for a researcher to find: pages under /embed/ are framable from any origin, because teachers and learning-management systems need to embed the calculators in their own pages. Those routes carry their own tighter Content Security Policy, no advertising, no analytics, and no site chrome. Every other route on the site is same-origin only.

Our security headers target grade A on securityheaders.com.

Responsible disclosure

If you find a security vulnerability, please tell us before you tell anyone else. Email support.cosyslabs@gmail.com with the subject “Security Vulnerability” and enough detail to reproduce the issue. We will acknowledge within 72 hours and keep you informed while we fix it. Please do not test against real visitors, and please give us a reasonable window to remediate before publishing.

Machine-readable contact details: /.well-known/security.txt

Arithmetic that disagrees with a syllabus is not a security issue, but we want that report just as much — send it to the same address, or through the contact page.