Buildcamp LogoHome

Security at Buildcamp

Last updated: 10 October 2026

We take reports of genuine vulnerabilities seriously and fix them. Please read this page before writing.

No bounty programme

Buildcamp is a small business and does not pay for reports, send rewards, or provide letters or acknowledgements. If you need payment for your work, please do not send a report.

How to report

Email hey@buildcamp.io with the steps to reproduce. We do not confirm receipt. We reply only if we need more information or when a fix ships, at our discretion.

Already known: not accepted as reports

  • The Supabase public (anon) key in page scripts. It only reaches data that is public by design.
  • The sign-in endpoint indicating whether an email has an account. It is rate-limited and CAPTCHA-protected.
  • Content-Security-Policy running in report-only mode during rollout.
  • Listing of the public image bucket.
  • Password-reset requests sending a notice with no link. Buildcamp has no passwords.
  • Missing or “weak” headers reported by automated scanners without a demonstrated impact.
  • Clickjacking, CSRF or rate-limit reports without a working proof of concept.
  • Social engineering, phishing, denial of service, and reports against third-party services (Stripe, Supabase, Vercel, Loops, Circle).

Rules

Please don’t access other people’s data, run automated scans that degrade the service, or contact students or staff about findings.

Legal

Buildcamp does not operate a bug bounty or a “safe harbour” programme. Access to Buildcamp systems is permitted only as a normal user of the service. Testing that goes beyond the rules on this page (including accessing, copying or altering other people’s data, bypassing payment, or disrupting the service) is unauthorised access under the Computer Misuse Act 1990 and may be reported to the police. Accessing students’ personal data is also a breach under UK GDPR, which we are obliged to record and may be obliged to report. Reports that include data taken from other users’ accounts will not be treated as good-faith research.