Platform security

Sensitive operations use established providers, access decisions happen server-side, and private course sources are kept outside public web folders. No online service is risk-free, but layered controls reduce exposure.

• Stripe processes card details, receipts, refunds, and fraud checks; NextPrep Academy does not store full card numbers or CVC codes.
• Checkout starts from an authenticated session and payment events are reconciled through signed Stripe webhooks.
• Firebase supports password and OAuth authentication. The application session uses an httpOnly cookie, hashed server-side token records, automatic expiry, and optional email verification.

• Private course source files are outside the public directory; authenticated API routes check session and entitlement before returning course pages.
• Production data uses the configured Firebase and Google Cloud services, with privileged Firebase Admin operations kept server-side.
• Sensitive API responses use private no-store caching where appropriate, state-changing requests use trusted-origin checks, and abuse-prone features use rate and size limits.

• Webhook idempotency reduces duplicate payment side effects, secrets belong in environment variables, and operational logs are limited to service and incident needs.
• Use a unique password, secure your email and OAuth account, do not share your account or private content, and report suspicious activity or unexpected charges promptly.

These controls do not guarantee uninterrupted, vulnerability-free service or immunity from unauthorized access. Responsible reports should include enough detail to reproduce and assess the issue without accessing other users' data.

To report a security concern, contact support@nextprep.academy.