Security

Report a problem

If you think you've found a security issue in portal.levelstair.com or api.levelstair.com, email admin@levelstair.com with "Security report" in the subject. Tell us what you found, how to reproduce it, and what an attacker could do with it.

We'll reply within 5 working days and keep you posted until it's fixed.

Please test only against your own account, don't access or change other members' data, don't run denial-of-service or spam tests, and give us a reasonable chance to fix the problem before you talk about it publicly. Act in good faith within these rules and we won't pursue you for your research.

How we protect accounts

• Passwords are hashed, never stored in plain text, and must be strong.
• Two-factor authentication is available to every member and required for every admin.
• Sign-in, sign-up and password reset are protected by bot checks and rate limits.
• Session cookies are HTTP-only and secure, and changing your password signs out your other devices.
• Admin actions are recorded in an audit log.
• All traffic uses HTTPS, and we collect only the data we need. See our Privacy Policy.