Security

Report a NativePath security issue

If you believe you found a vulnerability, report it privately with clear reproduction steps and minimal impact. We appreciate good-faith research that helps keep learners, admins and customers safe.

Email security report View security.txt

In scope

- Authentication and sessions
- Admin authorization
- Public and authenticated APIs
- Feedback, profile and public pages
- CourseOps and ArticleOps rendering
- AI routes and solution leakage prevention
- Promo, referral and XP reward integrity
- Mobile API

Out of scope

- Denial-of-service or high-volume load testing
- Social engineering or phishing
- Spam, SMS or email flooding
- Destructive testing outside assigned test data
- Third-party systems outside NativePath-owned configuration

Report template

Title:

Severity:

Affected URL/route:

Account used:

Environment:

Steps to reproduce:

Impact:

Evidence:

Suggested fix:

Data accessed:

Do not include secrets, session cookies or unrelated personal data. If private data is exposed accidentally, stop testing and include only the minimum evidence needed to prove impact.