Keeping your account safe.

• Encrypted everywhere. Every connection to sublevo.app is HTTPS, and browsers are told never to connect over plain HTTP.
• Your rows are yours. Every row of account and progress data in our database is locked to the account that owns it, enforced by the database itself — not just by the app. A signed-in student cannot read or change anyone else’s data, and a visitor who is not signed in can read none of it. We have tested this directly.
• Passwords are never stored. Only a one-way hash is kept, by our authentication provider. Passwords must be at least 8 characters.
• Safe password resets. A reset link works once, for a short time, and changing your password signs you out of every other device.
• No secrets in your browser. Keys that can bypass the database’s protections never leave our servers.
• Hardened pages. Sublevo cannot be embedded inside another site (which blocks click-jacking), and sign-in redirects only ever land on sublevo.app.
• Little to lose. We hold no payment details, no phone numbers and no addresses — see the privacy policy.

• Use a password you do not use anywhere else, or sign in with Google or GitHub.
• Sign out on shared or school computers.
• Sublevo will never ask for your password by email. Only type it on sublevo.app.
• If something looks wrong with your account, reset your password from the sign-in page and write to support@sublevo.app.

If you think you have found a security problem in Sublevo, please write to support@sublevo.app with “Security” in the subject line. Include what you found, the steps to reproduce it, and the pages or requests involved. Please do not share it publicly until we have fixed it.

We will acknowledge your report within a few working days and keep you told as we fix it.

We will not take action against anyone who reports a problem to us in good faith and follows these rules:

• test only against your own account — never access, change or delete anyone else’s data;
• if you reach someone else’s data by accident, stop, and tell us what you saw;
• no denial-of-service, flooding, spam, or automated scanning that degrades the site;
• no phishing or social engineering of students or of us.

Sublevo is a small, free project and does not run a paid bug bounty — but we are genuinely grateful, and will credit you if you would like.