Online-Exams.org holds exams, answers and grades, so it is built to keep them private and to keep an exam fair. This page describes how, in plain terms.
Encryption and browser protections
- Every connection uses HTTPS. HTTP Strict Transport Security tells browsers to use HTTPS only, for two years, on every subdomain.
- A strict Content Security Policy allows only the scripts our own pages issue, each marked with a one-time value. A script injected into a page will not run.
- Our pages cannot be framed by other sites, which prevents clickjacking. Responses cannot be loaded by other sites as resources, and browsers are told not to guess file types.
- The camera, microphone and location are switched off for every page. We never ask for them.
Accounts
- Passwords are stored only as bcrypt hashes. We cannot read them.
- Sessions are signed, HTTP-only cookies that page scripts cannot read. Changing your password signs out your other sessions.
- Sign-in, sign-up, password resets and exam entry are rate-limited against guessing.
- Password-reset links work once and expire.
Exam integrity
- The answer key never reaches a student's browser: not during the exam, and not on the results page. Answers are graded on our servers.
- Each attempt gets its own shuffled ids, so answers copied from another student's browser do not work.
- Answers are saved as students go, so a dropped connection loses nothing.
Hosting and payments
- The application runs on Vercel. Data is stored in a managed PostgreSQL database, encrypted at rest by the provider.
- Payments are handled by Stripe. Card details go straight to Stripe and never touch our servers. We store only a reference to your subscription.
- Secrets such as database and payment keys live in the hosting platform's encrypted environment, never in source code.
Reporting a vulnerability
If you believe you have found a security problem, email it@online-exams.org. Please include enough detail for us to reproduce it, and give us reasonable time to fix it before sharing it publicly. We will acknowledge your report and keep you updated.
Please do not access other people's data, disrupt the service or run automated scans that degrade it. Our contact details are also published at /.well-known/security.txt.