Encrypted secrets
- Checks show up here as soon as the server answers.
Private and secure
CoolRoom's security, checked every hour
Your school logins, your grades, your messages: here is how they are protected, and the results of the automatic checks that run on the real server every hour, following OWASP standards.
- OWASP ASVS 5.0 · L2
- API Top 10 · 2023
- every hour, at minute 7
The last 7 days, hour by hour
- All passed
- To watch
- At least one failure
- No check
The proof
What the server checks, every hour
Each check tests the running service, not a copy: the database, the API, the public addresses and the libraries. The references point to the OWASP requirements it covers. Details are in French.
Access
- Checks show up here as soon as the server answers.
Browser and transport
- Checks show up here as soon as the server answers.
Personal data
- Checks show up here as soon as the server answers.
Abuse
- Checks show up here as soon as the server answers.
Software
- Checks show up here as soon as the server answers.
Your school logins
Under two locks
To fetch your grades and homework every 5 minutes, CoolRoom has to log in to Pronote or Skolengo for you. So it keeps your login, but never in plain text.
- 01
A key just for you
Each login is encrypted with its own random 256-bit key, using AES-256-GCM.
- 02
The key, locked too
That key is itself encrypted by a master key kept outside the database (AES Key Wrap).
- 03
Bound to your account
The encryption is tied to your account and your school: copied anywhere else, it no longer opens.
- 04
Opened at the last moment
It is only decrypted to talk to your school, and never shows up in the logs.
A stolen database alone is not enough: without the master key it only holds unreadable text. CoolRoom's server itself can decrypt, because it needs to in order to sync: so this is not end-to-end encryption.
In place
The protections, one by one
Hashed passwords
Your CoolRoom password is never stored, only an Argon2id fingerprint. Very common passwords are refused.
Nothing without your session
The server checks every request: without a valid session, no private route answers. Parents only get a limited, read-only view.
Discreet notifications
By default a notification says "New grade", never the subject, the sender or the message. You can show the content in Settings.
Limited attempts
Login, two-factor, class and parent codes, connecting your school: after a few tries, you have to wait.
Logs without secrets
Passwords, tokens, keys and cookies are masked before anything is written, and the server re-reads its logs every hour.
Temporary photos
Photos read by OCR are not kept; chat photos leave the server after their time, and you can erase everything.
Watched components
The server's libraries are compared to known flaws every hour (OSV.dev), and the live version passed all its security tests.
Locked-down browser
HTTPS everywhere, a strict Content Security Policy, no unknown script, no page that can be framed.
Our reference
OWASP standards
OWASP is the foundation that publishes the security standards for web applications. We follow its ASVS 5.0 at level 2, the level meant for apps handling sensitive data, and its API Security Top 10.
The requirement-by-requirement detail is kept in our documentation and reviewed at every version. Internal assessment: no external audit has taken place yet.
ASVS 5.0 · level 1 and 2 requirements
253 requirements
- 132 verified
- 57 partly
- 9 to do
- 55 not applicable
OWASP API Security Top 10 · 2023
- API1Broken Object Level AuthorizationTested
- API2Broken AuthenticationVerified
- API3Broken Object Property Level AuthorizationPartly
- API4Unrestricted Resource ConsumptionVerified
- API5Broken Function Level AuthorizationVerified
- API6Unrestricted Access to Sensitive Business FlowsPartly
- API7Server Side Request ForgeryVerified
- API8Security MisconfigurationPartly
- API9Improper Inventory ManagementPartly
- API10Unsafe Consumption of APIsPartly
Honestly
What we don't claim
- No external audit yet: this proof comes from our own automatic tests. An independent audit will come later.
- No end-to-end encryption: the server has to read your school data to sync it.
- No system is unbreakable: we reduce the risks, measure them, and show what is wrong.
- A failing check stays shown until it is fixed: nothing is hidden to get an all-green board.
Report
Found a flaw?
Thank you! Tell us privately and don't publish the details before it is fixed. Describe what you saw and how to reproduce it, without touching other students' data.
We answer, we tell you when it is fixed, and we thank you here if you wish.
Write to the team Our security.txt file
No address at hand? In the app, tap the BETA badge on the home screen ("Report a bug") and start your message with "Security".
Page reviewed on 15 October 2026 · version 0.9.4