Security at StudyBonk
Secure by design: static pages, strict headers, no user data to breach. Found a vulnerability? Here's how to report it — and get thanked in the Hall of Bonk.
Architecture
StudyBonk is a fully static site: HTML, CSS and client-side JavaScript served from Cloudflare's global edge network. There is no backend, no database, no login system, and no server-side storage. The most common web attack surfaces simply do not exist here.
What remains is hardened: a strict Content-Security-Policy that forbids third-party scripts, X-Frame-Options and frame-ancestors to prevent clickjacking, referrer policy, and no cookies for attackers to hijack. Sensitive local data (like AI chat history) is encrypted at rest with a device-local key via the WebCrypto API.
- Strict CSP: scripts and styles load from this origin only
- No third-party scripts, ever — the entire supply chain is auditable
- Zero cookies — nothing session-shaped to steal
- Client-side AES-GCM encryption for sensitive localStorage entries
- Zero data retention: there is no server-side retention because there is no server-side
The local AI's security model
Bonk AI runs inside your browser sandbox. In Instant Mode there is no network activity at all. When you opt into a full model, the only network request is a one-time download of public, read-only model weights from a public model CDN — it contains no information about you, and model weights can't record prompts.
Prompts are processed by your own GPU/CPU, and history is stored encrypted in local storage with a one-click destroy button.
Responsible disclosure & bug bounty
Found a security issue? Please report it privately via GitHub Security Advisories on the StudyBonk repository (github.com/TuffyCoder/StudyBonk/security/advisories/new) — or open a private security advisory if you prefer. Please don't test destructive techniques or try to degrade service for others.
StudyBonk's bug bounty is gratitude-based: confirmed reporters earn a permanent place in the Hall of Bonk below, a shout-out in release notes, and the warm glow of protecting students. (There's no cash bounty — this is a free, zero-revenue project. But the thanks are extremely sincere.)
Hall of Bonk
No entries yet — the hall awaits its first hero. Could be you.
Found something? Report privately: GitHub Security Advisory.
No accounts. No tracking. Open-source.
Every promise on this page is verifiable — see the proof or read the code.
Zero data collection
StudyBonk has no accounts, no analytics, no cookies and no server-side storage. Your notes, decks and streaks live only in your browser's local storage on your own device.
Open-source transparency
The entire platform is open-source on GitHub. You can read every line of code — including this page — before you trust it with a single minute of study time.
A named, accountable author
Every page is written and maintained by TuffyCoder, an ethical developer who publishes under a real identity with public social channels and a responsible disclosure policy.
Ready to bonk your brain into shape?
No sign-up. No ads. No tracking. Your progress saves automatically in your browser — start in the next ten seconds.