Security

Most security pages are a list of reassuring nouns. Here's the other half, because you deserve to calibrate your trust accurately:

• No compliance certification. We are not SOC 2, ISO 27001, or HIPAA certified, and we've had no third-party security audit or penetration test.
• No security team. This is an early-stage project maintained by one person. There is no 24/7 on-call rotation and no formal incident response programme.
• No durability guarantee. Please don't treat Praxis924 as the only home for anything important. Keep your own copy of work you'd be upset to lose.
• No two-factor authentication yet. Use a strong, unique password — ideally from a password manager.

None of this means we're careless. It means we'd rather tell you where the edges are than let you assume guarantees that don't exist.

Worth repeating from the privacy policy, because it's a security decision you make every time you type: text you send to the AI tutor, mock interviews, or code grading is transmitted to third-party AI providers (Groq, Google Gemini, Hugging Face, or NVIDIA), and code you run is executed on a third-party sandbox service.

Never paste credentials, API keys, personal data, or your employer's proprietary code into those features. We can't un-send it on your behalf.

• Use a unique password you don't reuse anywhere else.
• Don't share your account.
• If you suspect your account is compromised, change your password and tell us immediately.

If you find a security issue, please report it privately to jayantsingh924@gmail.com or through the contact form. Include what you found, how to reproduce it, and what an attacker could do with it.

Our commitment: we'll acknowledge your report, keep you updated on the fix, and credit you publicly if you'd like. We will not pursue legal action against good-faith research that follows the rules below. There's no bug bounty — no money, just genuine gratitude and credit.

Please do:

• Give us a reasonable window to fix it before disclosing publicly.
• Use only your own test accounts.
• Stop as soon as you've confirmed a vulnerability exists — proving access is enough; you don't need to explore it.

Please don't:

• Access, modify, or delete other people's data.
• Run denial-of-service tests, spam, or automated scanning that degrades the service for real users.
• Use social engineering against users or the operator.

If a breach affects your data, we'll tell affected account holders by email with what we know, what was affected, and what to do — promptly, and without waiting for a perfect narrative.