Security & Responsible Disclosure

• Static site served over HTTPS from Vercel's edge network with modern TLS; HSTS enabled.
• No user accounts on the website means no password database to steal; progress data lives only in your browser.
• AskZ, the Smart Notes and the assignment generators run on Cloudflare Workers: requests are checked for origin, rate-limited per IP, moderated for content (chat), and secrets are held in Cloudflare's secret store, never in code. Generated documents are cached per topic; forcing a regeneration needs an admin credential. Admin pages require Cloudflare Access login.
• The code labs run inside your browser: the pseudocode, SQL, assembler and Prolog engines are our own sandboxed interpreters with step limits, and Python runs in a Web Worker (WebAssembly) with a timeout that terminates a runaway program. None of them can reach your files or the network.
• Payment card data is never collected by us.
• Dependencies are kept current; the site is rebuilt and redeployed from source on every change.
• Third-party scripts are limited to Google Analytics (opt-in in the EU/EEA, UK and Switzerland, on by default elsewhere; off as soon as you turn it off in the cookie banner or footer, or send a Global Privacy Control signal) and the Python runtime, which is fetched from jsDelivr at a pinned version only when you run Python and only inside a Web Worker.

If you believe you have found a security vulnerability in cswithzak.com, AskZ (chat.askzbot.com or the site drawer), ZAPP, or our infrastructure, please email [contact@cswithzak.com](mailto:contact@cswithzak.com) with “Security” in the subject line. Include:

• the URL or component affected;
• the type of issue and its impact;
• steps to reproduce (a proof-of-concept is welcome; a screenshot or short video helps);
• your name/handle if you would like credit, and how to contact you.

Do not include any personal data of other users in your report beyond the minimum needed to show the issue.

Our commitments: we acknowledge within 3 working days, keep you informed, aim to fix critical issues within 14 days and others within 90 days, tell you when it is fixed, and — with your permission — thank you on this page. We do not currently run a paid bug-bounty programme; ZAK will, however, send merchandise from the Souvenir shop to researchers who report a genuine issue.

We will not pursue legal action, or report you to the authorities, for security research carried out in good faith that follows these rules:

• Only test against your own data and sessions; do not access, modify or delete other people's data (including AskZ conversations, leads or testimonials that are not yours). If you stumble on someone else's data, stop, do not download it, and tell us.
• No denial-of-service, no resource exhaustion, no flooding AskZ with automated requests, no spam.
• No social engineering of ZAK, the admissions team, centre staff or students; no physical attacks on premises.
• Do not publicly disclose the issue until we have fixed it or 90 days have passed, whichever is first; we are happy to coordinate a disclosure date.
• Stop as soon as you have enough evidence to demonstrate the issue.
• Comply with applicable law, including the Prevention of Electronic Crimes Act 2016; this safe harbour is our promise about our actions and cannot bind third parties (for example Cloudflare or Vercel) whose infrastructure you must not attack.

Out of scope: vulnerabilities in third-party sites we link to (PapaCambridge, Blogger, YouTube, WhatsApp, the app stores), missing best-practice headers with no demonstrated impact, self-XSS, clickjacking on pages with no sensitive actions, results of automated scanners without a working proof-of-concept, the LLM (or a Smart Notes / assignment document) producing wrong or “jailbroken” answers unless it leaks data or executes actions, and a program you write in one of the labs hanging or crashing your own tab.

A machine-readable version of this policy is published at /.well-known/security.txt in the RFC 9116 format. Preferred languages: English, Urdu.

If we suffer a security incident that affects personal data, we will notify affected people and the relevant authorities without undue delay, explain what happened, what data was involved and what we are doing about it, and post a notice on the /legal hub.

No reports yet. Be the first.