Security and vulnerability disclosure

How MasterLinux protects your data, and how to tell us if you find a flaw.

What we do

End-to-end encrypted traffic (HTTPS, TLS 1.2 and 1.3, HSTS), strict security headers (Content-Security-Policy, frame isolation), protected cookies (HttpOnly, Secure, __Host- prefix).

Passwords hashed with scrypt (never stored in clear text), email verification at sign-up, two-factor authentication (one-time code) available to everyone and mandatory for administrators, login attempt limits, a log of logins and devices visible in your profile.

Payments delegated to PayPal: MasterLinux never sees, stores or transmits your card numbers. Payment notifications are cryptographically verified before anything changes on your account.

Hardened server (unprivileged service account, read-only system, administration over a private network only), daily encrypted backups kept off the server, tamper-evident audit log of sensitive actions, automatic monitoring and alerts.

Almost no third-party code runs in production beyond a few audited libraries; the code is analysed automatically (static analysis, dependency audit) before every release and the tools provided to learners are signed.

Reporting a vulnerability

If you believe you found a flaw on https://masterlinux.online, email contact@masterlinux.online with the subject “Security”. Describe the issue, the steps to reproduce it and, if possible, its impact. You may write in English, French or Arabic.

We acknowledge within 72 hours, keep you informed of progress and credit you (if you wish) once the fix is live. Critical flaws are fixed first, usually within 72 hours; others within 30 days.

We do not take legal action against good-faith research: no access to data that is not yours beyond what is strictly needed to demonstrate the flaw, no alteration or destruction of data, no service disruption, no public disclosure before the fix (or 90 days after your report).

Out of scope

Denial-of-service or volumetric attacks, social engineering, phishing of our users, physical access, automated scanner output without a demonstrated impact, theoretical best practices without an exploitation scenario (versions, missing headers without consequence), and third-party services (PayPal, Google) which run their own programmes.

Your data

You can download a copy of your data or delete your account at any time from your profile. Our privacy policy details what we keep and why. For any question about security or data protection: contact@masterlinux.online.

https://masterlinux.online/.well-known/security.txt