Security
How we protect your data and how you can report a security vulnerability to us.
How we protect your data
- In production, communication between the app and the server uses an encrypted connection (HTTPS).
- Messages are stored encrypted on the server. The server manages the keys, so messages are not protected in a way that only your device can decrypt; authorised processes can decrypt them.
- Administrator access is recorded: authorised administrators may view conversations for security and legal obligations, and every access is written to an immutable audit log. Deleted messages may be retained for security and legal obligations.
- Passwords are stored irreversibly (as hashes); session refresh tokens are also kept only as hashes.
- Sign-up is only possible with bingol.edu.tr email addresses and email verification.
- Rate limits apply to sign-in, verification and write endpoints.
Reporting a vulnerability
If you believe you have found a security vulnerability, please report it to us privately first. We welcome good-faith reports that follow the rules below.
- Include the affected address or endpoint, steps to reproduce and the likely impact.
- Do not access, delete or modify other people’s data, and do not run tests that disrupt the service (heavy load, denial of service).
- Do not disclose publicly until the issue is fixed.
- We will try to respond when we receive your report.
Scope
- In scope: the BÜ Kampüs mobile app, this website and the API.
- Out of scope: university systems on bingol.edu.tr and its subdomains (report those to the relevant unit), social engineering, physical attacks and third-party services.
Contact
Send your reports to the contact address below.
Tips for users
- Do not reuse your password on other services.
- If you see suspicious content or a suspicious user, report it from the app.
- Keep your device and the app up to date.
Enable JavaScript in your browser for the interactive version of this page.