Security

What we have in place

• Encrypted connections. The site is served only over HTTPS, so information you send us is encrypted in transit.
• Managed sign-in. Accounts run on Supabase Authentication. Passwords must be at least 8 characters and are stored hashed by Supabase, never in plain text. The password reset form does not reveal whether an account exists.
• Database access controls. Our database uses row-level security, so each table only releases data to the people allowed to see it. Most changes go through our own server code rather than directly from the browser.
• Limited access. The member app is open only to signed-in, approved members, and admin tools only to our team. Children’s logins cannot open the member app.
• Spam and bot protection. Our forms validate every field, use rate limits and hidden spam traps, and our interest forms use Vercel BotID to block automated submissions.
• Verified payment messages. We check the signature on every message from Stripe before acting on it.

We do not hold security certifications and have not had an external audit. As we grow, we will add more, and update this page when we do. How we handle personal information is explained in our Privacy Policy.

Payments

Membership and other purchases are paid on Stripe’s hosted checkout pages. Your card number and billing details go straight to Stripe, a PCI-certified payment provider, and never touch our servers. We only receive your name, email address and a customer reference.

Keeping your account safe

• Use a strong password you do not use anywhere else.
• Do not share your login, even with friends in the community.
• We will never ask for your password by email or message. Be wary of messages that do.
• If you notice something odd on your account, reset your password and email support@edventures.co.

Reporting a vulnerability

If you think you have found a security problem in edventures.co or the member app, please email security@edventures.co with a description, the steps to reproduce it, and the pages or URLs involved. We will acknowledge your report, keep you updated as we look into it, and let you know when it is fixed.

We do not run a bug bounty program and cannot offer payment for reports, but we are grateful for them and are happy to thank you publicly if you would like.

What we ask of researchers

• Only test against your own account, and never access, change or delete other people’s data. If you come across personal information, especially about children, stop, do not keep it, and tell us.
• Do not run denial-of-service attacks, heavy automated scanning, spam, or social engineering of our team or members.
• Give us a reasonable time to fix the problem before you tell anyone else about it.

If you report in good faith and follow these guidelines, we will not pursue legal action against you for your research.