# Security and Incident Response

Version: 2026-07-22.3  
Status: technical readiness draft, not an audit or certification

## Current safeguards

- Content Security Policy limits scripts, images, forms, objects, and connections.
- The only optional external connection is HTTPS metadata lookup from `en.wikibooks.org`.
- Network requests omit credentials and referrer data.
- Online text cannot generate formulas, assessments, structures, or game actions.
- No cookies, browser persistent profile, analytics, advertising, camera, microphone, or geolocation are used.
- Saved worlds and concern reports are local user-initiated downloads.
- Dependency versions are pinned in `package.json` and the production build is reproducible.
- Generated mentor plans pass local schema, formula, curriculum, disclosure, human-agency, fairness, and provenance checks before display.

## Threats considered

The review scope includes dependency compromise, malicious or unexpected online metadata, cross-site scripting, data leakage, oversized or malformed save data, denial of service, unauthorized changes to the teaching catalog, misleading AI output, and exposure of learner records in a deployed service.

## Incident process required for deployment

1. Provide a monitored public security contact and an internal incident owner.
2. Record the report time, affected version, systems, data categories, and initial severity.
3. Contain the issue, disable the affected service or lookup when necessary, and preserve appropriate evidence.
4. Determine whether personal or student data was affected and which contracts or laws apply.
5. Notify affected organizations and people within applicable deadlines after legal review.
6. Patch, test, deploy, document root cause, and verify recovery.
7. Add a regression test and publish an appropriate incident summary.

## Vulnerability and dependency work still required

- Establish automated dependency and source scanning in the deployment repository.
- Produce a software bill of materials and signed release artifacts.
- Commission penetration testing and a secure-code review.
- Add availability monitoring, backups, recovery tests, access control, and audit logging if a backend is introduced.
- Define severity, notification, retention, and vendor-management policies with qualified security and legal reviewers.

## Legal and contractual boundary

A real deployment must identify all applicable obligations, potentially including COPPA, FERPA, state student-privacy and breach laws, accessibility rules, institutional contracts, and international requirements. This document does not make a compliance claim.