Security policy

1. Platform Safeguards

• HTTPS protects connections to the CaseCrest website.
• Authentication and permission checks help restrict competition, team, judging, organisation, and administrative functions to authorised users.
• Input validation, file restrictions, request limits, and browser security protections help reduce common forms of misuse.
• Application tests, dependency reviews, and error monitoring help identify defects and security issues. No single control prevents every type of attack.

2. Data and File Access

CaseCrest relies on infrastructure providers, including Supabase and Vercel, for services such as authentication, databases, file storage, and hosting. Protection also depends on provider safeguards and how services are configured.

Access to competition materials depends on the relevant role, team membership, competition settings, and release status. Some files are made available through authorised download routes or time-limited links. Public listings and published portfolio information are intended to be visible to others.

Restricted access is not end-to-end encryption and cannot prevent an authorised recipient from downloading or sharing material. Follow competition confidentiality rules and only upload information you are authorised to share.

3. User Responsibilities

Help protect your account and other users:

• Use a strong, unique password and protect the email account used to sign in or reset it.
• Do not share passwords, verification codes, password-reset links, private invitations, or restricted download links.
• Keep your devices and browser updated, sign out of shared devices, and review who has access to your team or organisation.
• Treat uploaded files and external links with care, and report suspected unauthorised access promptly.

4. Reporting a Vulnerability

Email support@casecrest.org with “Security report” in the subject. Include the affected page or feature, when the issue occurred, steps to reproduce it, and the potential impact. Redact credentials, access tokens, and other people's personal information from screenshots and logs.

Use accounts and data you control. Do not access or change other people's data, disrupt services, run denial-of-service tests, or test third-party systems without their permission. If you encounter someone else's information, stop and report the minimum details needed to identify the issue.

Give us a reasonable opportunity to investigate and address a report before publishing details that could put users at risk. This policy does not grant permission for unrestricted testing or promise a reward or response deadline.

5. Incidents and Limitations

When we become aware of a security incident, we assess its impact and take appropriate steps to contain and address it. We will notify affected people and relevant authorities where required by applicable law.

No online service can guarantee absolute security or uninterrupted availability. This policy describes safeguards, not a security certification or a guarantee that every vulnerability will be prevented. It does not limit rights or obligations that cannot lawfully be excluded.