Security & vulnerability disclosure

Security approach

CourseKit uses defence in depth across tenant isolation, authentication, provider credentials, private assets, application changes, audit evidence, and operations. Controls are reviewed against the risks of a multi-tenant learning and commerce platform.

Report a vulnerability

When testing, please:

• use only accounts, schools, sites, and data you own or have explicit permission to test;
• avoid denial of service, automated high-volume scanning, spam, social engineering, and physical attacks;
• do not access, modify, retain, or disclose another person’s data;
• stop and report immediately if you encounter customer data or a secret; and
• allow reasonable time for investigation and remediation before public disclosure.

We will acknowledge a good-faith report, investigate it, keep you reasonably informed, and not pursue legal action for research that follows this policy and applicable law. This is not permission to test third-party providers such as Stripe, Webflow, Zoom, Bunny.net, Cloudflare, Resend, or PostHog.

Security incidents

If you believe an active account compromise, data exposure, or service incident is occurring, email security@coursekit.cloud with “URGENT INCIDENT” in the subject. For harmful customer content or misuse, use abuse@coursekit.cloud.