ClassHub is actively developed for engineering college sections. Security updates and patches are applied to the active branch.

We take the security of student and institutional data seriously. If you discover a security vulnerability, do not open a public issue on GitHub.

1. Privately contact the project maintainer, Himanshu Saini, or report via the repository private vulnerability reporting feature on GitHub.
2. Provide a clear description of the vulnerability including:
   • Type of issue (such as authentication bypass, RLS policy leak, injection, rate limit violation).
   • Step-by-step reproduction instructions or a proof-of-concept payload.
   • Impact assessment on student data or section isolation.
   • Affected files, endpoints, or database tables.

• Initial acknowledgment: Within 48 hours of report receipt.
• Triage and assessment: Within 5 business days.
• Fix and patch deployment: Priority patches are deployed to production immediately upon verification.

All contributions to ClassHub must uphold our fundamental security requirements:

• Every table has PostgreSQL Row-Level Security enabled.
• All read, write, and delete policies enforce section-level boundary checks.
• Sensitive stored procedures run with SECURITY DEFINER only when strictly required and set explicit search_path = public.

• Every query operating on section data must explicitly filter by section_id.
• Users cannot read, modify, or infer data belonging to other college sections.

• Only @skit.ac.in Google Workspace accounts are permitted to access the application.
• Domain checks are verified during authentication callbacks and enforced by PostgreSQL database triggers.

• ClassHub never asks for, accepts, stores, or scrapes third-party ERP credentials.
• All attendance analysis uses student-pasted data parsed locally on client devices.

• General polls must never store student identifiers in response records.
• Voting relies on one-way salted tokens (calculate_anonymous_token) to prevent double voting while preserving ballot privacy.

• Only public client keys (VITE_SUPABASE_ANON_KEY) are bundled into frontend assets.
• Administrative service role keys and push notification private keys remain restricted to Supabase Edge Functions.