We use cookies for analytics (Google Analytics) and advertising measurement (Meta pixel) to understand how this site is used. No cookies are set until you choose. Learn more.
Security
Security at ProgramArchitect
Last updated: September 2026
A plain description of how we handle security today, and — more importantly — a clear way to tell us if you find something wrong. We're a small, early-stage team; this isn't a claim of perfection, it's an honest account of real practices plus an open door for anyone who finds a gap in them.
1. Report a vulnerability
If you believe you've found a security vulnerability in ProgramArchitect or learningarchitectures.com, please tell us before telling anyone else. We take reports seriously and will respond.
Please include: what you found, the steps to reproduce it, and its potential impact. Proof-of-concept code is welcome; please don't include real customer data in a report even if you encountered some while testing.
What to expect: we'll acknowledge your report within 2 business days, and aim to give you a real assessment (confirmed, not reproducible, or already known) within 5 business days. We'll credit you (if you'd like) once a fix ships, and we'll keep you updated rather than go silent.
2. Responsible disclosure — what we ask
Give us a reasonable window to investigate and fix an issue before disclosing it publicly.
Don't access, modify, or delete data that isn't yours — the moment you confirm a vulnerability exists, stop there and report it rather than pushing further.
Don't use automated scanners that could degrade the service for real users (this includes not testing against the rate limits described below by intentionally trying to exceed them at scale).
Testing done in good faith, within these guidelines, won't result in legal action from us for the testing itself.
3. Practices actually in place today
Specific, not generic — this is what's really running in production, not a marketing checklist:
Session handling: sign-in sessions use an HttpOnly, Secure, SameSite=Lax cookie — never exposed to page JavaScript or stored in a URL or localStorage.
Admin authentication: compared using a timing-safe equality check, not a plain string comparison, to avoid a timing side-channel.
Rate limiting: every route that costs real money per call (AI generation), sends email, or is auth-adjacent (sign-in, password reset, email confirmation, access codes) is rate-limited per IP and, where relevant, per email/token — both a short burst window and a daily cap.
Uploaded file validation: the one place this app accepts user-supplied binary content (organization logo uploads) validates the real file signature (magic bytes), not just the filename or declared content type, before any image-processing library ever touches it.
Error handling: internal error details (stack traces, raw exception text) are never returned in an API response — every user-facing error is a fixed, generic message, while the real detail is captured server-side for our own debugging.
Monitoring: every real failure is logged with a unique reference ID and triggers an alert to our team (throttled so a burst of the same failure pages us once, not on every occurrence).
Dependencies: automatically audited on every code change and monthly on a schedule, independent of whether anything else changed that month.
Secrets: API keys and credentials live only in our hosting provider's environment configuration, never in source code, and are rotated on a defined schedule.
Infrastructure: hosted on Netlify (static assets + serverless functions) with a managed Postgres database; we don't run or patch our own servers, which removes an entire category of infrastructure-level vulnerability.
If something above is wrong, incomplete, or you think we're missing something important, email us about it — even if it's not a full vulnerability report.
If we discover a security incident that affects your personal data, we'll notify the people affected without undue delay, and in any case within 72 hours of becoming aware of it, by email to the address on your account. That notice will describe what happened, what data was involved, and what we're doing about it. If the incident is still being contained at that point, we'll say what we know so far rather than wait for a complete picture before saying anything.
We don't hold a formal certification such as SOC 2 or ISO 27001. If your organization needs a security questionnaire completed or a signed agreement, email support@learningarchitectures.com with "Security" in the subject line and we'll work through it with you.