Skip to content
Security & Responsible DisclosureLast updated: April 30, 2026

Security

Learners rely on Exampia to prepare for high-stakes language certifications. This policy outlines our technical safeguards and how security researchers can report potential vulnerabilities under Safe Harbor.

Reporting a Vulnerability

If you suspect a security vulnerability on our website or application surfaces, please email security@exampia.com. Include the affected URLs or endpoints, clear steps to reproduce, potential impact, and any relevant proof-of-concept details. Please do not include personal learner data unless strictly necessary to demonstrate the issue.

In-Scope Surfaces

Our public vulnerability disclosure scope covers:

  • The Exampia public website and localized marketing pages under exampia.com;
  • The Exampia Web Exam Studio and public API endpoints owned and operated by Exampia;
  • Authentication, session handoff, and first-party static assets.

Out-of-Scope Activities

To protect learner availability and privacy, researchers must not perform any of the following:

  • Denial-of-service (DoS/DDoS) attacks, volumetric stress testing, or aggressive automated scanning;
  • Social engineering, phishing, or physical security testing against Exampia personnel;
  • Accessing, modifying, or exfiltrating data belonging to other users or accounts;
  • Testing third-party infrastructure providers (cloud hosts, payment processors, or app stores);
  • Publicly disclosing an unpatched vulnerability before Exampia has had a reasonable remediation window.

Safe Harbor Guarantee

If you act in good faith, comply with this policy, avoid privacy violations or service disruption, and report findings confidentially, Exampia will consider your research authorized and will not initiate legal action against you.

Response & Triage SLA

We aim to acknowledge receipt of valid reports within 3 business days, provide an initial technical triage assessment within 10 business days, and notify you when remediation is deployed.

Baseline Technical Protections

  • Strict HTTPS/TLS encryption across all web and API edge endpoints;
  • Hardened HTTP security headers including Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy;
  • Automated dependency auditing and static analysis in CI/CD pipelines;
  • Minimal third-party client scripts and zero advertising trackers by default.