Security

Security is a baseline, not a feature. This document briefly explains how we protect accounts and data, and how to report a vulnerability.

1. Encryption

All connections use HTTPS / TLS 1.2+. HSTS is enabled. Database data is encrypted at rest on the hosting provider side.

2. Authentication

Passwords are stored only as hashes with a modern algorithm and random salt — we never see them in plain text and cannot recover them. Session cookies use HttpOnly, Secure, and SameSite flags. Two-factor authentication is on the roadmap.

3. Access controls

Least-privilege principle: admin systems are accessed by a small number of accounts, each with MFA. All admin actions go to an audit log.

4. Backups

Encrypted daily backups stored separately from production. Restore is tested regularly.

5. Responsible vulnerability disclosure

Found a vulnerability? Email security@learnpython.academy. Please give us time to fix it before going public (we ask for 90 days). We reply within 1 business day and keep you posted. We do not currently run a paid bug bounty, but we will credit you (optional) for the disclosure.

6. Incident response

If we detect a data breach, we will notify affected users and relevant supervisory authorities within the timeframes required by law (for example, 72 hours under GDPR Art. 33).

7. What's on you

• Use a unique password for your account.
• Don't share your login with anyone.
• If you notice suspicious activity, tell us right away.

Security reports: security@learnpython.academy