Security

1. Security measures

Catchie uses a combination of technical and operational controls. Depending on the feature, these include HTTPS, authentication and session controls, restricted private areas, server and application access controls, security-related HTTP headers, traffic filtering, software updates, and error/security logging.

2. HTTPS

Catchie is served over HTTPS. HTTPS encrypts information while it travels between a user's browser and the website. The canonical public address is https://catchie.link/.

3. Private and administrative areas

Catchie contains private, classroom, account, staff, and administrative areas that are not intended for unrestricted public access. Attempting to bypass those controls without authorization is prohibited.

4. Security monitoring

Technical information may be logged when needed to detect abuse, diagnose errors, prevent unauthorized access, investigate security incidents, or protect service availability.

5. Network and delivery protection

Catchie currently uses Cloudflare for content delivery, caching, traffic management, and protection against malicious or abusive traffic.

6. Responsible disclosure

If you believe you found a vulnerability, send the affected URL, a clear description, reproduction steps, possible impact, and useful technical evidence to [email protected]. Clearly mark the report Security Issue.

7. What researchers should avoid

• accessing another user's private information;
• downloading more data than necessary to demonstrate an issue;
• changing or deleting another user's information;
• disrupting Catchie services or intentionally overloading the site;
• introducing malware or performing destructive testing;
• publishing unresolved vulnerability details in a way that unnecessarily puts users at risk.

8. Account security

Users should keep passwords private, avoid sharing restricted classroom credentials, sign out on shared devices when appropriate, and report unexpected account activity. Catchie support does not need your password to investigate an ordinary support request.

9. Security limitations

No website can guarantee absolute security. Security controls reduce risk but cannot eliminate every vulnerability, attack, software defect, or third-party failure.

10. Abuse reports

For inappropriate content, impersonation, account misuse, or similar concerns that are not technical vulnerabilities, use Report a Problem.