Security Policy

Last updated: October 16, 2026

We want StudyCerts to be safe for everyone who studies with us. If you believe you have found a security vulnerability, please tell us. This policy explains how to report it, what is in scope, and how to test without putting other people or their data at risk.

Reporting a Vulnerability

Email security@studycerts.com. Please include:

  • A description of the issue and the affected page, feature, or URL.
  • The steps to reproduce it, with any requests or screenshots.
  • What an attacker could do with it.
  • How we can reach you with follow-up questions.

This address is for security reports only. For help with your account, billing, or study content, contact support@studycerts.com.

What to Expect

  • We aim to acknowledge your report within 5 business days.
  • We will confirm whether we can reproduce the issue and keep you updated while we work on a fix.
  • We will let you know when the issue is resolved.

Scope

In scope: the StudyCerts website at StudyCerts.com and the services we operate behind it.

Out of scope:

  • Third-party services we use, such as our payment processor and hosting and sign-in providers. Please report issues in those to the provider directly.
  • Denial-of-service attacks, load testing, and high-volume automated scanning.
  • Social engineering or phishing of our staff or learners, and physical attacks.
  • Automated scanner output, missing security headers, email configuration (SPF, DKIM, DMARC), version disclosure, self-XSS, and clickjacking on pages without sensitive actions, unless you can show a concrete impact.

Testing Guidelines

  • Only test with accounts you own or have created for testing.
  • Do not access, change, or delete other people's data. If you come across it, stop, do not keep a copy, and tell us in your report.
  • Do not bulk-download practice questions or other paid study content. Showing access to a single item is enough to demonstrate an issue.
  • Do only what is needed to demonstrate the issue, and do not degrade the service for others.
  • Keep the details private until we have fixed the issue or agreed with you on a disclosure date.

Safe Harbor

If you make a good-faith effort to follow this policy, we will consider your research authorized, we will not take legal action against you for it, and we will not report it to law enforcement. If a third party takes legal action against you for research that followed this policy, we will make it known that you acted in line with it. This does not authorize testing of third-party services. If you are unsure whether something is allowed, ask us first.

Rewards

We do not run a paid bug bounty program and do not pay for reports. Please do not make sharing the details of a vulnerability conditional on payment.

Changes to This Policy

We may update this policy from time to time. We will update the "Last updated" date above when we do. A machine-readable version of our contact details is published at /.well-known/security.txt. Our Privacy Policy explains how we protect the personal information you share with us.