Engineering
How the platform is put together.
We found the same hole twice, in two systems written a year and a half apart by people solving unrelated problems. Neither was a subtle cryptographic mistake. Both were the same sentence, written twice: The browser told us which organisation this request is for, and we believed it.
An organisation's address serves three separate applications: They are three builds, from three directories, with three bundles. They share a domain, a session and a design system,…
A learner scored 120 out of 300 on a project. The admin console showed 300%. The instructor console showed 0%. The student's own course card showed 12000%. Nobody had written a bug…
Every organisation on the platform gets its own address and its own branding. The obvious way to build that is to fetch the branding when the app starts. We did, and it was wrong i…
