Security

We teach cyber defense, so here is how we protect IDCC itself, and how to report a vulnerability if you find one.

1. How we protect the Service

• Sign-in: multi-factor authentication with an authenticator app is required for every learner and administrator.
• Data storage: data is stored with Amazon Web Services in the Tokyo region and encrypted in transit (TLS) and at rest.
• Payments: Square tokenizes card details in your browser, so they never reach our servers. Payment notifications are signature-checked and processed exactly once.
• Least privilege: each part of the system has only the permissions it needs.
• Lab isolation: labs are isolated from our other systems, have no cloud (IAM) permissions, stop automatically when their time runs out and are deleted when they stop.
• Website: idcc.center runs no scripts at all and is served with a strict content security policy.
• Content safety: all course content and AI output is escaped before it is displayed.

For company customers, we can answer security questionnaires and provide more detail. Email contact@idcc.center.

2. Reporting a vulnerability (vulnerability disclosure policy)

If you find a vulnerability in the Service, email security@idcc.center, in Japanese or English.

In scope: idcc.center, app.idcc.center, the IDCC API, and the lab environments (including escaping a lab or reaching another learner's lab).

Out of scope: vulnerabilities in third-party services such as Square or AWS themselves (report those to them), denial-of-service attacks, social engineering, physical attacks, and reports that are only automated scanner output.

Rules for research

• Use only your own account and data. Access other users' data only as far as you must to prove the issue, then stop and report it at once.
• Don't change or delete data, or disrupt the Service.
• Don't disclose the issue publicly before it is fixed. We aim to fix issues within 90 days of your report, and we will agree a disclosure date with you.

What we promise

• We will acknowledge your report within 3 business days and keep you updated.
• We will not take legal action against you, or report you to law enforcement, for good-faith research that follows this policy.
• With your permission, we will thank you by name on this page once the issue is fixed. We do not currently offer a bug bounty.

Our reporting contact is also published in security.txt.