Reporting a security issue

How to report

If you think you have found a security problem in Melaa, email security@melaa.app. We acknowledge every report within 2 business days.

What to include

• What you found and where (the page or address).
• Steps to reproduce it.
• What someone could do with it.
• How to reach you if we have questions.

Please

• Don't access, change or download student data or anyone else's account. If you reach data that isn't yours, stop and tell us.
• Don't disrupt the service: no denial-of-service tests, spam or social engineering of schools or our team.
• Give us a reasonable chance to fix the issue before you share it publicly.

Good-faith research

We won't take legal action against anyone who researches and reports an issue in good faith and follows these rules.

Other questions

For questions about how student data is handled, email privacy@melaa.app. Machine-readable contact details are in security.txt.