Security at StackGrasp
How we protect accounts, payments, and platform data.
Account protection
Passwords are hashed, never stored in plain text. Every sign-in requires a one-time emailed security code as a second step, unless you've enrolled real TOTP two-factor authentication (an authenticator app, with one-time backup codes) — enrolled accounts use that instead. A signed-in session token can't be individually revoked, but resetting your password immediately invalidates every other active session, including one an attacker might be holding.
Data encryption
Data encrypted in transit (TLS) and at rest for account, payment, and Essence Credit records.
Payment security
Payments processed via PCI-compliant providers; StackGrasp does not store raw card numbers.
Course moderation
All submitted courses pass through the moderation queue before publishing, with reporting for post-publish issues.
Infrastructure
Access controls, audit logging, and monitoring across production systems.
Smart contracts
On-chain components (mastery credentials, skill bounties) run on Polygon and are treated as unaudited by a third party until a formal audit is completed.
Report a vulnerability
Found a security issue? Email security@stackgrasp.com. Please don't test against production without permission.