Account separation
Teacher-owned classes, students, submissions and protected photos are checked against the signed-in teacher account.
SECURITY
Security controls in the v2.0 foundation.
Designed for a controlled private beta before wider school deployment.
Server-side secrets
OpenAI, PayPal, email and storage secrets stay in environment variables and are not sent to the browser.
Production transport
Production mode requires HTTPS, secure cookies, trusted hosts and same-origin protections for browser writes.
Billing verification
Paid entitlements are activated from PayPal-verified subscription state; webhook signature verification is supported for production.
Cloud storage
Production mode requires private S3-compatible object storage rather than serving a shared local uploads directory.
Health checks
/health reports process health; /ready checks database readiness without exposing student data.