Security & vulnerability disclosure

If you believe you have found a security vulnerability in The IQ Gym, please report it to us privately before disclosing it publicly. We will acknowledge your report and work with you on a fix.

How to report

Send details to info@theiqgym.com, or use the contact form and mark the subject as a security report. Contact us.

Please include the affected URL, the steps to reproduce, and what you were able to access or change. A short proof of concept helps enormously.

Safe harbour

We will not pursue or support legal action against researchers who act in good faith: who report promptly and privately, who do not access, modify, or delete other people's data beyond the minimum needed to demonstrate the issue, who do not degrade the service, and who give us reasonable time to fix the issue before publishing.

In scope

• Authentication, session handling, and access control between accounts.
• Injection, cross-site scripting, and cross-site request forgery.
• Exposure of personal data, assessment results, or unreleased question content.
• Any way to obtain answer keys for live questions without answering them.

Out of scope

• Volumetric denial of service, or any testing that degrades service for other users.
• Social engineering of our staff or users, and physical attacks.
• Missing security headers or best-practice findings with no demonstrated impact.
• Vulnerabilities in third-party hosting infrastructure we do not control.

What we already do

The IQ Gym enforces HTTPS with HSTS, a strict Content-Security-Policy with per-request nonces, anti-forgery validation on every form, rate limiting on authentication and test endpoints, and hashed password storage via ASP.NET Core Identity. We use no third-party trackers or advertising scripts.