Security Policy

Responsible disclosure

Reporting a vulnerability

Please do not disclose a security vulnerability publicly. Report it to hello@scormbusters.com with a description of the vulnerability, steps to reproduce, the potential impact, and any suggested fix.

You'll receive an acknowledgment within 48 hours and a resolution timeline within 7 days.

Scope

In scope: authentication bypasses, authorization flaws, SQL injection, XSS, CSRF, data exposure, SCORM/LTI injection. Out of scope: vulnerabilities in dependencies (report those upstream) and theoretical attacks with no practical exploit path.

After disclosure

Once a fix is deployed we'll publish a brief advisory and credit the reporter, unless you prefer anonymity.