What we hold, and who can read it

There is no public read access to the certificate table. A signed-in student can read their own certificates and nothing else. Staff can read the ledger. Everyone else gets nothing back from the database directly.

The only public path is verification, and it answers one question at a time: does this exact certificate ID exist, and is it still valid?

1. You paste a certificate ID at /verify.
2. The ID is checked against a strict format, then looked up on the server as one exact match. Partial matches, wildcards, and listings are not possible.
3. If the record exists, the page returns verification fields only: the name on the certificate, the course, the issue date, the curriculum version, and whether it has been revoked. Never an email address, never an account ID, never progress or scores.
4. If the record does not exist, the page says so and nothing else.

Each verification - hit, miss, or malformed - is written to a server-side audit log with the ID that was queried, the outcome, a one-way hash of the visitor, and the timestamp. We do not store raw IP addresses. The log is readable by staff only and is never exposed to the browser.

Verification and assessment submissions are throttled per visitor and per account. IDs are random and the ID space is large, so guessing your way to a valid certificate is not a practical attack.

Quizzes and finals are graded and recorded server-side. The browser cannot write an attempt row, cannot set its own score, and cannot issue itself a certificate.

A certificate can be revoked by the registrar; the verification page then states plainly that the credential is no longer valid. If you want your verification page removed entirely, email hello@thirdpolararch.com and we will do it.

Found something that looks wrong? Email hello@thirdpolararch.com with what you did and what you saw. No bounty, no lawyers, just a fast fix.