Security Notes
The current Academy pilot and public website are intentionally small: static front ends with no connected accounts, payments, classrooms, or score service.
1. What Is Connected
A React + TanStack Start site. It has optional local analytics consent, but no login, payment, or database connection.
A static Vite/PWA build. It has no API URL, account system, classroom server, payment provider, or leaderboard submission. Progress is local to the browser.
Separate repositories reserved for a later integration phase. They are not called by the pilot and are not required for first-user testing.
2. Student Data During Testing
The pilot does not ask for names, email addresses, passwords, room codes, school records, or payment details. Testers should avoid entering personal data into the study screen or sending it in feedback.
- No student PII is collected by the Academy build.
- Local progress can be cleared by clearing browser site data.
- Teachers testing in a classroom should use the app on trusted devices and follow local policy.
3. Deployment Notes
Both the website and Academy are static builds. There are no secrets, database bindings, or payment keys required for first-user testing. Keep testers on one origin so local progress remains available.
# Academy cd repos/spanbound-academy npm ci npm run build # Website cd repos/spanbound-website npm ci npm run build
Serve the generated output from a static host. Do not add API URLs or secrets until the integration phase starts.
4. Responsible Disclosure
If you find a security issue in the website or a build, report it privately. Our machine-readable policy is published at /.well-known/security.txt.