The beta rules

Your invitation is the written permission section 6 of the Acceptable Use Policy asks for before anyone tests our systems. Good-faith research inside these rules is safe: we will not report it, sue over it or close your account for it.

In scope

• Everything at acada.ac: the pages, /api/*, the Supabase endpoints the app calls, the storage buckets, the emails the app sends, and what the policies promise.
• Your own accounts, and test accounts you declared in the ACADA Beta room.
• Reading, changing or doing anything your role should not be able to.

Out of scope

Other people's data

If you reach something that is not yours, stop at proving it: one record, a screenshot, a report. Do not read on, copy, change or delete.

Availability

No flooding, load testing, filling storage or exhausting rate limits for their own sake. One request that proves a limit is missing is enough.

Other companies

Stripe, PayPal, Supabase, Vercel, Resend, Sentry, Anthropic and Google are not ours to test.

People

No social engineering of us or other testers, no phishing, no physical access.

Spam

No mass messages, emails, reports or sign-ups. Test anti-abuse controls with one or two.

Publishing

Nothing about a finding leaves the private channel until we say it is fixed, or for 90 days, whichever comes first. Then write it up, with credit.

What we promise

• A reply within 2 business days, Critical and High fixed before other work, and a note when the fix is live.
• Credit, if you want it, on a security acknowledgements line at launch.