Security Policy & Responsible Disclosure
At Ednex Academy, protecting student data, inquiry submissions, and educational infrastructure is a top priority. We welcome responsible disclosures from the security research community.
1. Security Controls in Place
Our website and API endpoints incorporate multi-layered defense practices:
- Transport Layer Security: All client-to-server traffic is encrypted using standard TLS/HTTPS.
- Server-Side Hardening: Production headers include
X-Content-Type-Options: nosniff,X-Frame-Options: SAMEORIGIN, and strict referrer policy directives. - API Protection: Lead capture endpoints enforce input sanitization, honeypot bot defense, length validation, and isolated audit directory permissions (
data_secure/.htaccess: Deny from all). - Zero Client Storage of Sensitive Secrets: The website avoids caching any private administrative tokens or personal student records in public browser storage.
2. Responsible Disclosure & Safe Harbor
If you identify a potential security vulnerability in our public application, we encourage you to report it to us responsibly. In return, we commit to:
- Reviewing your report promptly without threatening legal action, provided you adhere to this policy.
- Treating your submission confidentially while remediation is underway.
- Acknowledging your helpful contribution once the issue has been validated and resolved.
3. Scope & Rules of Engagement
In-Scope:
- Public web application at
https://ednexacademy.com/ - Lead submission API at
https://ednexacademy.com/api/lead.php
Strictly Out of Scope:
- Denial of Service (DoS / DDoS) attacks or automated volumetric stress testing.
- Social engineering, phishing, or physical intrusion against students, instructors, or facility personnel.
- Spamming contact or lead forms with false or repetitive payloads.
- Viewing, modifying, or deleting other users' data beyond the minimum necessary to demonstrate a proof-of-concept.
4. Reporting Instructions
Please send your findings with reproducible technical details to our dedicated security inbox:
- Email: academy.ednex@gmail.com
- Subject Line:
[Security Vulnerability Report] <Short Summary> - Include in Report: Vulnerability description, URL/endpoint affected, reproducible step-by-step instructions or cURL command, and expected impact.
Please allow our engineering desk 3 to 5 business days to review and acknowledge your submission before sharing details publicly.