Security

How we protect your data and keep the SkillMonster platform secure.

Operator: SkillMonster is a global supplemental learning platform. Services on this site are operated by AdzMonster Private Limited, India.

TLS Encryption

All data in transit is encrypted with TLS 1.3

Password Security

Passwords hashed with bcrypt (cost factor 12)

Data Encryption

Sensitive data encrypted at rest (AES-256)

Security Audits

Regular penetration testing and vulnerability scans

Security Practices

HTTPS enforced across all endpoints with HSTS headers
Content Security Policy (CSP) headers with nonce-based script allowlisting
Rate limiting on all API endpoints to prevent abuse
Session tokens rotated on login; invalidated on logout
SQL injection prevention via parameterized queries (Prisma ORM)
XSS protection via React's DOM escaping and CSP
Dependency vulnerability scanning via automated CI checks
Two-factor authentication available for all accounts

Responsible Disclosure / Bug Bounty

We welcome security researchers to report vulnerabilities. If you discover a security issue, please report it via our contact page with full details. We ask that you:

  • • Give us reasonable time to investigate and fix before public disclosure
  • • Avoid accessing or modifying other users' data
  • • Not perform denial-of-service attacks

We acknowledge all valid reports and offer recognition (Hall of Fame) for significant findings.

Compliance:SkillMonster follows India's Digital Personal Data Protection Act (DPDP Act 2023) and IT Act 2000 guidelines. SOC 2 Type II audit is currently in progress.