Skip to main content

Security and privacy

Ticks are recorded live

Work these steps on the in-app checklist — account menu → My testing checklist — where every Pass / Fail / Skip is recorded the moment you press it, and Fail files the report for you. This page (and its PDF) is the same list for reading, printing, or working offline; if you used paper, transfer your ticks into the app afterwards.

Do NOT try to damage real data. Use the testing org only.

Each step: Do this, then check You should see.

  • SEC-01 Open another org's project URL while signed in to your org. You should see: 403/404-style 'not available' page; no data leaks, no org switch happens by itself.

  • SEC-02 As an annotator, call the export URL of a project you are a member of (paste it in the browser). You should see: refused — annotators cannot export.

  • SEC-03 As an annotator, try to open Settings of the project. You should see: no Settings tab; direct URL is refused.

  • SEC-04 Change your email; check the old address gets a notice and the new one a verification. You should see: both emails arrive; login keeps working until verified per the docs.

  • SEC-05 Create an API token; call /api/current-user/whoami with it; revoke it; call again. You should see: 200 then 401.

  • SEC-06 Create a read-only token and try a write. You should see: 403 'token is read-only'.

  • SEC-07 Check that a frozen org's members cannot write (coordinator freezes). You should see: 423 on writes, reads work.

  • SEC-08 Open the privacy/consent receipts in your profile. You should see: each consent you gave is listed with time and version; export works.

  • SEC-09 Delete your account (on a throwaway tester). You should see: data handling matches the docs (retention/anonymisation); login fails afterwards.

  • SEC-10 Look at cookies and storage after logout. You should see: no tokens left in localStorage; session cookie cleared.