This platform holds personal data belonging to real students — names, email addresses, and photographs of university ID cards submitted during registration. We would rather hear about a problem awkwardly than not hear about it, so please report anything you find.
Do not open a public issue. Use GitHub's private reporting instead:
Go to the affected repository → Security tab → Report a vulnerability
That opens a private advisory visible only to the maintainers. Private reporting is enabled on all repositories in this organisation.
If you cannot use that for any reason, contact one of the organisation owners directly on GitHub and ask for a private channel before sending details.
- What the problem is, and what an attacker could do with it
- The steps to reproduce it — the smallest sequence that shows the issue
- Which part is affected:
sustcpgeeks.me,api.sustcpgeeks.me, or a repository - Anything you already ruled out
A clear report with reproduction steps is far more useful than a scanner's output.
In scope:
sustcpgeeks.meandapi.sustcpgeeks.me- cp-geeks-backend and cp-geeks-frontend
Out of scope — please do not do these, they affect real members:
- Denial of service, load testing, or any automated scanning against the live site. We run on a single small server; a scan is indistinguishable from an outage and will take the platform down for everyone.
- Social engineering of club members or administrators
- Anything that requires accessing another member's account or data to demonstrate
Stop, and report it immediately. Do not download, copy, screenshot or share it, and do not test how much of it you can reach. ID card photographs are identity documents belonging to students who did not consent to that. Telling us the door is open is the whole contribution — you do not need to walk through it to prove the point.
This is a student-run club project, not a company with an on-call rota. We cannot promise a response time, but we will acknowledge a report as soon as we see it, tell you honestly whether we can fix it and roughly when, and credit you when it is resolved if you would like that.
We do not operate a bug bounty and cannot offer payment.
If you are a club member and something looks wrong with your own account — you are seeing someone else's data, or your data appears on a page it should not — that is a security report, not a normal bug. Please use the private channel above rather than an issue.