🛡️ Transport Security & Data Protection

All data transmission between your browser and our platform is encrypted in transit using standard HTTPS / TLS (Transport Layer Security) protocols. To ensure data privacy and prevent unauthorized tampering:

• Transport Encryption: Modern TLS protocols protect communication channels against eavesdropping and man-in-the-middle attacks.
• Password Hashing: User passwords are never stored in plain text. They are securely transformed using the industry-standard Bcrypt one-way hashing algorithm with individual random salts.
• HTTP Security Headers: Our web application enforces security response headers, including X-Frame-Options: SAMEORIGIN to prevent clickjacking, X-Content-Type-Options: nosniff to prevent MIME-sniffing, and Referrer-Policy: strict-origin-when-cross-origin.

🔐 Session Integrity & CSRF Defenses

User authentication and authenticated sessions are safeguarded through robust session lifecycle management:

• Encrypted Session Identifiers: Session tokens are regenerated upon authentication and stored using secure, HttpOnly cookies to protect against unauthorized script extraction.
• Cross-Site Request Forgery (CSRF) Protection: Every state-altering HTTP request (POST, PUT, DELETE) is validated against a unique, cryptographically signed CSRF token.
• Role-Based Access Control: Strict backend middleware inspects route permissions, separating administrative, instructor, and student capabilities.

💳 Payment Security & Razorpay Verification

Online payment transactions (for course registrations, training programs, and study material) are processed through certified third-party payment gateways:

• PCI-DSS Compliant Gateway: Online card and net-banking transactions are processed through Razorpay's PCI-DSS Level 1 compliant infrastructure.
• No Cardholder Data Stored: We do not collect, process, inspect, or store credit/debit card numbers, CVV codes, or netbanking passwords on our application servers.
• Server-Side Cryptographic Verification: All payment completion notifications undergo server-side HMAC-SHA256 signature verification and direct API confirmation with Razorpay before curriculum access is unlocked.

🚫 Request Filtering & Abuse Prevention

To preserve application stability and protect student data against automated abuse:

• Application-Level Request Filtering: Custom security middleware inspects incoming HTTP requests to detect and drop common automated scanning attempts, directory traversal probes, and unauthorized configuration requests.
• Rate Limiting & IP Blocking: Abusive clients engaging in excessive request flooding or repeated malicious activity are throttled and subject to temporary or persistent IP bans.
• Server Secrets Isolation: Server API keys and third-party credentials reside exclusively in isolated server-side environment configurations and are never exposed to the client browser.

💡 Responsible Vulnerability Disclosure

We welcome constructive reports from security researchers. If you discover a potential vulnerability on our platform, please practice responsible disclosure: report it to us privately via email, do not disrupt services or attempt to access other users' private data, and allow our team reasonable time to investigate and deploy a fix.