Legal
Security
Last updated: August 24, 2026
Security pages are useful only when they match the actual system. This overview describes the safeguards built into the current platform; it is not a formal security certification.
Credential protection
Student, tutor, and admin passwords are never stored in plain text. First-time users receive a short-lived setup link before they can choose a password.
Secure sessions
Sessions use signed, HTTP-only cookies. We apply CSRF protection on state-changing requests and rate limits on sensitive actions like login and messaging.
Safe by design
PeerTutor is free for everyone, so there's no checkout, no card data, and no payment information to protect. That removes an entire class of risk for students and tutors alike.
Tutor review
New tutor profiles start in review. Admins and approved master tutors can approve, reject, suspend, or restore tutor profiles before they are shown as active.
Server-side authorization
Admin tools, tutor approval, account creation, lesson actions, messaging, and classroom access all check the signed-in user's role on the server before data is read or changed.
Resume upload controls
Tutor résumés are limited to PDF files, capped at 5 MB, checked by file signature on the server, and stored with generated path-safe filenames.
Browser hardening
The site sends a Content Security Policy, clickjacking protection, referrer controls, content-type sniffing protection, and a restrictive permissions policy.
Release checks
Before launch we run type checking, linting, production build checks, dependency audit, keyboard navigation checks, and mobile overflow checks on critical pages.
Data handling
All input is validated on the server, and access to every resource is authorized — you can only read and act on data you own or are a participant in. We use parameterized database queries throughout to guard against injection, and we escape user-generated content to prevent cross-site scripting. Secrets such as database URLs, session keys, SMTP credentials, and storage service keys are server environment variables and are not exposed through public client-side configuration.
Admin and tutor controls
Account creation and tutor approval are handled through authenticated admin or master tutor tools. Those pages are not public admin panels: the server checks the caller’s role before rendering management pages or accepting API mutations.
Launch review
AI-assisted code is reviewed like untrusted code. Before release, we verify the production build, run dependency and type checks, inspect public privacy/security copy, and test keyboard and mobile behavior on the main learning flows.
Your part
Security is shared. Use a strong, unique password, keep it private, and sign out on shared devices. Never share login codes, and be cautious of anyone asking you to move a conversation off the platform or to pay for tutoring — PeerTutor is always free.
Reporting a vulnerability
If you believe you’ve found a security issue, we’d like to hear from you. Send details and steps to reproduce through the contact page, and give us a reasonable chance to respond before any public disclosure.