Reporting a bug

A security finding goes by email, privately. Anything else goes through the Feedback button on any page, or in the ACADA Beta room. A course, profile, message or review that breaks a rule goes through its own Report button, like any member's.

How to report a bug

1. 1.

   Choose the Feedback button in the corner of the page where it went wrong.

2. 2.

   Choose Something broke, Suggestion or Question. For something broken, choose a Priority: Critical, High, Medium or Low.

3. 3.

   Say what you did and what happened instead, and choose Send. Signed out, add your email so we can reply.

What happens next

• It becomes a support ticket that a person reads. The page, your browser, window size and time zone go with it, and nothing on the page.
• Signed in, you are emailed a copy with its ticket number, and Start here shows what became of it. Signed out, the number shows in the panel.
• A fix is listed in What's new when it ships; something we decide to leave goes on Known issues.

A security finding

A security finding reaches data or actions that are not yours, or breaks a control. Email it to support@acada.ac with Security at the start of the subject. Never post it in a room or publicly until we say it is fixed. We reply within 2 business days, fix Critical and High before other work, and tell you when the fix is live. Section 6 of the Acceptable Use Policy is your safe harbour.

Writing one we can act on

• One report per bug, with the address and the account you were using.
• Numbered steps, then what you expected and what happened.
• Whether it happens always, sometimes or once.
• Evidence: a screenshot, a recording or a console error. For anything under /api, the request and response from your browser's network tab, with your own token removed.

Severity

Critical

Taking over an account; reading or changing another member's private data; moving money that should not move; running code on our servers.

High

Doing what your role cannot; a stored injection another member would see; getting past a control a policy promises.

Medium

A rate-limit bypass with a real effect; leaking who is enrolled or who reported; a workflow that loses data without saying so.

Low

Harmless information that should be private; wrong wording; a page that is hard to use; an accessibility gap not in the statement.

If something goes wrong

"A few more words would help."

Write at least a short sentence.

"A valid email lets us reply."

Signed out, add an email address.