What is deliberately not here

The action set is closed

The program this one succeeds could spawn arbitrary processes from data inside an exam file — a remote-code-execution primitive distributed as courseware. Here the action set is closed and capability-scoped: show a message, show media, navigate, branch, set a flag, call a declared webhook. There is no process spawn, and no extension point through which one could be added.

No shared secret

The predecessor shipped with an encryption password that was identical in every copy ever sold, on a file that was an Access database with the extension changed. A secret that every customer holds is not a secret.

Here every pack gets its own random key, wrapped into key slots — a passphrase, a colleague's public key, this device, an entitlement, or a key an invigilator releases only inside the exam window. No key is compiled into any binary, no key is shared between customers, and there is no master key that would let us open your files.

The container is encrypted and so is its directory, because for an exam paper the structure is disclosure: a ZIP tells you the question count before you decrypt a byte. Signing is Ed25519, with key material kept separate from encryption. The specification and its test vectors are published, the reference decoder ships with every shell, and a build gate asserts that any key holder can always export the whole thing in the clear — encryption protects a paper from a candidate, not an author from us.

Two devices, no server

Two machines on the same network sync directly. They authenticate by key rather than by account — "same account" is a claim a network cannot check, and a stolen token would satisfy it — and on the first pairing both screens show the same six digits. If the digits differ, something is answering in the other device's place, and the screen says to stop rather than showing a warning icon nobody reads. Note what that does not forbid: a rendezvous relay carrying the frames between two buildings changes nothing, because it forwards them verbatim and cannot open one — and if it swapped a key instead, it would change the handshake transcript, and the two numbers would differ. The check is the same check, which is why the same screen can offer both routes. After that the traffic is XChaCha20-Poly1305 with a counter that makes a replayed or reordered frame a refusal, because a repeated "push these changes" is exactly how two copies of a library are made to disagree. On the desktop the native side carries sealed bytes it cannot read; every decision with a security consequence is the same code Android runs.

A paper that cannot be read before the exam

A sitting has its own key pair. The paper is sealed to the public half and can be distributed a week early; the secret half stays with the invigilator until the window opens. A sealed paper has no passphrase fallback, so there is exactly one door. An early release — a fire drill, a timetable change — needs a name and a reason, and every request, granted or refused, is recorded so an appeal has something to read.

A licence can never change a mark

Entitlements are signed tokens checked on the device, with no call to us: a laptop in a hall verifies one from a public key alone, and a lapsed licence has a grace period so a school whose card expired over the holidays is not locked out mid-exam. What a licence may do is decide whether a screen opens. What it may never do is affect a grade, and that is enforced structurally rather than promised: a test fails the build if the grading engine ever depends on the licence package.

No card numbers

The old back office stored customers' credit-card numbers. Card details go to the payment processor and never to us. An assessment company that stores card numbers has taken on the compliance burden of a payments company for no revenue.

What runs where

• Marking happens on the device. A grade does not depend on reaching us, which is also why an offline sitting is not a degraded sitting.
• The LTI signing key never leaves the server, and the gradebook credential never reaches a device.
• Self-hosting is first-class. Point the server at your own Postgres and the data is on your estate.
• Webhooks must be declared by the pack before an item can call one, so a rule cannot reach an arbitrary host.

Determinism as a security property

Randomised papers are seeded and the seed is recorded with the attempt; access arrangement arithmetic is integer; scores are recomputed from stored attempts rather than served from a cache. Each of these exists so that a disputed result can be reproduced exactly, months later, by someone who was not there.

Reporting a vulnerability

Mail hello@zayeed.org with "security" in the subject. Please include enough to reproduce the issue and give us a reasonable window before publishing. Reports about the grading engine's correctness are equally welcome and are treated with the same seriousness — a marker that is wrong is a security problem for the person being marked.