MyCampus

Security overview

MyCampus protects school and student data with defense-in-depth controls. Organizational policies and incident procedures live in SECURITY.md and docs/compliance/.

Highlights

  • Authenticated sessions via Supabase Auth (verified JWT claims)
  • Tenant isolation via RLS and school-scoped permissions
  • Service-role key never exposed to the browser
  • Audit logging for administrative and academic mutations
  • Public share links expire and can be rotated or revoked

Report a vulnerability

Please email the operators via the contact channel on the home page with steps to reproduce. Do not disclose student PII in public issues.

Full program: Trust Center.