Security

Last updated: 13 August 2026

OpSecX is a security education platform. Protecting learner accounts, payments, and course access is central to how we build and operate our services. This page summarizes our security practices and explains how to report vulnerabilities responsibly.

1. How we protect the platform

We apply technical and organizational measures appropriate to the data we process, including:

  • Passwordless authentication — sign-in uses email one-time codes and optional WebAuthn passkeys. We do not store account passwords.
  • Privileged access controls — administrative accounts require additional passkey step-up verification for sensitive actions.
  • Secure sessions — HTTP-only session cookies, CSRF protection on account-changing requests, and short-lived access tokens with rotating refresh sessions.
  • Default-deny API access — backend routes require authentication unless explicitly published for public use.
  • Authorization by design — access to orders, enrollments, messages, and other user-owned data is enforced in application and database queries, not only in the user interface.
  • Transport and browser security — encryption in transit (TLS), strict Content Security Policy with per-request nonces in production, and other security headers on the web application.
  • Payment separation — payment card processing is handled by PayPal and PayU; we do not store full card numbers on OpSecX servers.
  • Secrets and configuration — sensitive integration credentials are stored encrypted and keys are managed securely.
  • Administrative accountability — sensitive admin changes are recorded in an audit log.
  • Infrastructure — production services run on US-based cloud infrastructure (Amazon Web Services and DigitalOcean). See our Privacy Policy for data location and subprocessors.

No system is perfectly secure. We continue to review and improve our controls as the platform evolves.

2. Responsible disclosure

If you believe you have found a security vulnerability in OpSecX, we appreciate responsible notification. Please report it to us before public disclosure or broad exploitation.

2.1 Contact

Email cs@opsecx.com with the subject line Security vulnerability report.

2.2 What to include

  • A clear description of the issue and the potential impact.
  • Step-by-step instructions to reproduce the behavior.
  • Affected URLs, accounts (if relevant), and any proof-of-concept materials.
  • Your contact information so we can follow up.

2.3 In scope

  • The OpSecX website and application at opsecx.com and its API.
  • Authentication, authorization, session handling, checkout, and account flows on our platform.

2.4 Out of scope

  • Third-party services we integrate with (for example PayPal, PayU, Zoho Mail, AWS, or DigitalOcean) — report those to the respective provider.
  • Social engineering, phishing, or physical attacks against our staff or users.
  • Denial-of-service or load-testing against production without prior written approval.
  • Issues requiring unlikely user interaction, already-deprecated browsers, or out-of-date client software.
  • Missing security headers or best-practice findings with no demonstrated exploit on OpSecX.
  • Spam, availability of public information, or support requests unrelated to security.

2.5 Research guidelines

  • Do not access, modify, or delete data belonging to other users.
  • Do not degrade service availability or exfiltrate large volumes of data.
  • Use test accounts you control where possible.
  • Give us reasonable time to investigate and remediate before any public disclosure.

2.6 Our response

We aim to acknowledge reports within a reasonable timeframe and will work in good faith to investigate valid issues. We may ask for additional information. We do not operate a paid bug bounty program at this time.

We request that researchers act in good faith and comply with applicable laws. We will not pursue legal action against security research conducted in accordance with this policy and with no harm to our users or platform.

3. Privacy and data requests

For privacy-related questions, data access, or erasure requests, see our Privacy Policy and contact cs@opsecx.com.

4. Contact

OpenSecurity India
Bangalore, India
Security reports: cs@opsecx.com