الأمن والإفصاح المسؤول

• Served over HTTPS from Cloudflare's edge network (Cloudflare Workers) with modern TLS; HSTS enabled. Every page also sends a Permissions-Policy that switches off the camera, location, payment, USB and other device features the site never uses (the microphone is allowed only for AskZ's voice typing, and only when you press the mic), and a Content Security Policy listing the only places scripts, frames and connections may come from — your browser blocks anything not on that list and reports what it blocked (the page path and the blocked address, never query strings or personal details), and pages cannot be framed by other sites.
• Signing in is optional and passwordless — we email you a one-time code — so there is no password database to steal. Each code allows five tries, counted on the server before any guess is compared, plus a daily limit per network, so codes cannot be guessed; asking for codes again and again cannot lock you out. The address and code in the email's sign-in link are removed from the address bar as soon as the page opens. If you never sign in, your progress data lives only in your browser.
• AskZ, the Smart Notes and the assignment generators run on Cloudflare Workers: requests are checked for origin, rate-limited, moderated for content (chat), and secrets are held in Cloudflare's secret store, never in code. AskZ's daily limits are counted on the server (per account, or per one-way hash of the network address for guests) in a single counter that two requests cannot race past, never trusted from the browser; a guest's photo upload must first pass Cloudflare Turnstile's bot check. Uploaded photos and files are read into text and never stored, and the text AskZ reads from them is treated as material, not as instructions. Generated documents are cached per topic; forcing a regeneration needs an admin credential. ZAK's Studio (admin tools) answers only his own signed-in account and needs a second factor from an authenticator app; the remaining admin page requires Cloudflare Access login.
• The code labs run inside your browser: the pseudocode, SQL, assembler and Prolog engines are our own sandboxed interpreters with step limits, and Python runs in a Web Worker (WebAssembly) with a timeout that terminates a runaway program, and once Python has loaded the worker's network, storage and messaging are switched off, so a shared program cannot read your saved notes or answers. None of them can reach your files or the network.
• Everything people write — Corners posts, AskZ replies, notes — is escaped before it is shown, links are checked against an allow-list, and nicknames that imitate staff are refused. Our own servers (the AskZ Worker) send the same baseline security headers as the site, verify every webhook's signature, and keep admin and operations views invisible to everyone else.
• Payment card data is never collected by us.
• Dependencies are kept current; the site is rebuilt and redeployed from source on every change.
• Third-party scripts are limited to Google Analytics (opt-in in the EU/EEA, UK and Switzerland, on by default elsewhere; off as soon as you turn it off in the cookie banner or footer, or send a Global Privacy Control signal), the Python runtime, which is fetched from jsDelivr's Pyodide folder (the policy allows that path only, not the whole CDN) at a pinned version only when you run Python and only inside a Web Worker, and Cloudflare Turnstile, loaded from challenges.cloudflare.com only when a guest adds a photo to AskZ. The Java and VB.NET compilers are served from this site, run only inside Web Workers with their own policy (no network beyond this site; the Java worker may evaluate code it generates itself, nothing on our pages may), and switch off the worker's network and storage once loaded, so a shared program cannot reach out.

If you believe you have found a security vulnerability in cswithzak.com, AskZ (chat.askzbot.com or the site drawer), ZAPP, or our infrastructure, please email security@cswithzak.com with “Security” in the subject line. Include:

• the URL or component affected;
• the type of issue and its impact;
• steps to reproduce (a proof-of-concept is welcome; a screenshot or short video helps);
• your name/handle if you would like credit, and how to contact you.

Do not include any personal data of other users in your report beyond the minimum needed to show the issue.

Our commitments: we acknowledge within 3 working days, keep you informed, aim to fix critical issues within 14 days and others within 90 days, tell you when it is fixed, and — with your permission — thank you on this page. We do not currently run a paid bug-bounty programme; ZAK will, however, send merchandise from the Souvenir shop to researchers who report a genuine issue.

We will not pursue legal action, or report you to the authorities, for security research carried out in good faith that follows these rules:

• Only test against your own data and sessions; do not access, modify or delete other people's data (including AskZ conversations, leads or testimonials that are not yours). If you stumble on someone else's data, stop, do not download it, and tell us.
• No denial-of-service, no resource exhaustion, no flooding AskZ with automated requests, no spam.
• No social engineering of ZAK, the admissions team, centre staff or students; no physical attacks on premises.
• Do not publicly disclose the issue until we have fixed it or 90 days have passed, whichever is first; we are happy to coordinate a disclosure date.
• Stop as soon as you have enough evidence to demonstrate the issue.
• Comply with applicable law, including the Prevention of Electronic Crimes Act 2016; this safe harbour is our promise about our actions and cannot bind third parties (for example Cloudflare) whose infrastructure you must not attack.

Out of scope: vulnerabilities in third-party sites we link to (PapaCambridge, BestExamHelp, Blogger, YouTube, WhatsApp, the app stores), missing best-practice headers with no demonstrated impact, self-XSS, clickjacking on pages with no sensitive actions, results of automated scanners without a working proof-of-concept, the LLM (or a Smart Notes / assignment document) producing wrong or “jailbroken” answers unless it leaks data or executes actions, and a program you write in one of the labs hanging or crashing your own tab.

A machine-readable version of this policy is published at /.well-known/security.txt in the RFC 9116 format. Preferred languages: English, Urdu.

If we suffer a security incident that affects personal data, we will notify affected people and the relevant authorities without undue delay, explain what happened, what data was involved and what we are doing about it, and post a notice on the /legal hub.

No reports yet. Be the first.