Security
This is a translation of the German original. If the two differ, the German version applies.
Stifti holds data about young people. That is why we take security seriously and welcome reports.
How we protect Stifti
- School reports and dossiers are end-to-end encrypted. We cannot read them either.
- Sign-in runs through EAuth, with a passkey instead of a password if you like.
- We store sessions only as a hash. Anyone who reads the database cannot use it to sign in.
- All connections are encrypted (HTTPS).
- Our scripts and stylesheets are checked with Subresource Integrity, and a strict Content Security Policy blocks third-party code.
- Photos are redrawn so that hidden data such as the location does not come along.
- For our team: anyone using the admin area has to sign in again recently, and every action is logged.
Found a vulnerability?
Write to legal@stifti.ch with the subject "Security". Describe what you found and how to reproduce it.
- We reply within a few days.
- Give us time to fix the problem before you publish it.
- Do not access other people's data, and do not change or delete anything. A proof is enough.
- If you follow these rules, you do not need to fear legal action from us.
We cannot pay rewards yet, but we are happy to credit you by name if you wish.