Security notice

Access is grant-scoped. Unknown evidence is deny. Downloads are authenticated.

Report a vulnerability

Email security@pupilgate.example. Do not use the office inbox or a parent thread. There is no public bounty.

Controls in the product

• Session plus tab-safe request context
• Invite tokens hashed; GET does not redeem
• Outbox leases and consumer receipts
• Attachment hash and scan gate