Security at StudyBonk
Secure by design: static pages, strict headers, no user data to breach. Found a vulnerability? Here's how to report it — and get thanked in the Hall of Bonk.
Architecture
StudyBonk is a fully static site: HTML, CSS and client-side JavaScript served from Cloudflare's global edge network. There is no backend, no database, no login system, and no server-side storage. The most common web attack surfaces simply do not exist here.
What remains is hardened: a strict Content-Security-Policy that forbids third-party scripts, X-Frame-Options and frame-ancestors to prevent clickjacking, referrer policy, and no cookies for attackers to hijack. Sensitive local data (like AI chat history) is encrypted at rest with a device-local key via the WebCrypto API.
- Strict CSP: scripts and styles load from this origin only
- No third-party scripts, ever — the entire supply chain is auditable
- Zero cookies — nothing session-shaped to steal
- Client-side AES-GCM encryption for sensitive localStorage entries
- Zero data retention: there is no server-side retention because there is no server-side
The AI's security model
Bonk AI has two modes. Instant Mode runs entirely in your browser with zero network activity. In API Mode, prompts go directly from your browser to OpenAI's API over HTTPS using your own key — StudyBonk has no server in the path and never sees your prompts or your key.
Your API key is stored AES-GCM encrypted in local storage, and chat history is encrypted the same way with a one-click destroy button. Disconnecting the key deletes it from the device instantly.
Responsible disclosure & bug bounty
Found a security issue? Please report it privately via GitHub Security Advisories on the StudyBonk repository (github.com/TuffyCoder/StudyBonk/security/advisories/new) — or open a private security advisory if you prefer. Please don't test destructive techniques or try to degrade service for others.
StudyBonk's bug bounty is gratitude-based: confirmed reporters earn a permanent place in the Hall of Bonk below, a shout-out in release notes, and the warm glow of protecting students. (There's no cash bounty — this is a free, zero-revenue project. But the thanks are extremely sincere.)
Hall of Bonk
No entries yet — the hall awaits its first hero. Could be you.
Found something? Report privately: GitHub Security Advisory.
No accounts. No tracking. Open-source.
Every promise on this page is verifiable — see the proof or read the code.
Zero data collection
StudyBonk has no accounts, no analytics, no cookies and no server-side storage. Your notes, decks and streaks live only in your browser's local storage on your own device.
Open-source transparency
The entire platform is open-source on GitHub. You can read every line of code — including this page — before you trust it with a single minute of study time.
A named, accountable author
Every page is written and maintained by TuffyCoder, an ethical developer who publishes under a real identity with public social channels and a responsible disclosure policy.
Ready to bonk your brain into shape?
No sign-up. No ads. No tracking. Your progress saves automatically in your browser — start in the next ten seconds.