Security
Course Beacon is built to protect your institution's course data
and your team's accounts. Here's what that means in practice.
Account security
- Passwords are hashed with bcrypt and checked against known
data breaches at signup, so a password already leaked from
another site can't be reused here.
- Optional two-factor authentication adds a one-time code from
an authenticator app on top of your password -- see our
Help page for how to
turn it on.
- Login attempts are rate-limited to block automated password
guessing.
- Your session is regenerated the moment you log in, closing
off session fixation -- a technique that would otherwise let an
attacker hijack a session that existed before you signed in.
- Session cookies are marked HttpOnly, Secure, and SameSite, so
they can't be read by JavaScript or sent over an insecure
connection.
Data isolation
- Every college's course data lives in its own separate
database -- not shared tables with a "tenant ID" column
separating rows. There's no shared table for a bug or query
mistake in one tenant's code path to reach into another tenant's
data through.
- Every database query is built with parameterized statements,
never by concatenating strings together, which closes off SQL
injection as an attack surface entirely.
Application security
- All user-supplied content is escaped before it's rendered as
HTML, preventing cross-site scripting.
- Every form that changes your account or directory settings is
protected against cross-site request forgery with a one-time
token.
Payments
Payment is handled entirely by Stripe. We never see, receive, or
store your card number -- Stripe only ever tells us back your plan
status and subscription dates.
Infrastructure
Every page is served over HTTPS. Course Beacon is hosted on
Railway's cloud infrastructure.
Questions
If you have questions about our security practices, reach out
through our Contact page.