Security Policy

How NORSU Campus Marketplace protects your account and information, what you can do to stay safe, and how to tell us about a security problem.

Last updated: October 30, 2026

1. How we protect your account

  • Secure connection: every page is served over HTTPS
  • Scrambled passwords: stored only as a secure hash, never as plain text
  • Email check at sign-up: a 6-digit code proves the email address is yours
  • Protected email changes: changing your email needs your password and a code sent to the new address
  • Password guessing is slowed down: after 5 wrong passwords, logging in to that account pauses for a minute
  • One-time links and codes: password reset links and email codes work once and expire

2. How we protect the site

  • Forms are protected so other websites can't send them on your behalf
  • Uploaded photos are checked to be real images and resized before they are saved
  • Private files, such as settings and backups, cannot be opened from the web
  • Browsers are told not to show the site inside other websites, to prevent click tricks
  • The site's data is backed up regularly so it can be restored after a problem

3. How you can stay safe

  • Use a password you don't use on any other site
  • Never share your password or email codes. We will never ask for them.
  • Log out when you use a shared or school computer
  • Be careful of messages asking you to pay before meeting, or to continue on another app
  • Meet in a public place on campus and check the item before you pay

4. Think your account was misused?

Reset your password with Forgot password? on the login page, then email [email protected] from your account's email address and tell us what happened.

5. Reporting a security problem

If you find a weakness in the site, please email [email protected] with the subject Security report. Tell us what you found, the steps to see it, and the page or address involved.

While looking into it, please:

  • Only use your own account or test accounts, and don't view or change other people's information
  • Don't slow the site down, send spam, or trick other students
  • Give us a reasonable time to fix it before telling anyone else

We aim to reply within 7 days. We won't take action against anyone who reports a problem in good faith and follows these rules.

6. Related

See the Privacy Policy for what we keep and who can see it, and the Terms and Conditions for the rules of the marketplace.