Security: BSolonenko/freeCodeCamp

Security

docs/security.md

freeCodeCamp.org's Security Policy

This document outlines our security policy for the codebases, platforms that we operate, and how to report vulnerabilities.

Reporting a Vulnerability

Note

If you think you have found a vulnerability, please report it responsibly. Do not create GitHub issues for security issues. Instead, follow this guide.

Guidelines

We appreciate responsible disclosure of vulnerabilities that might impact the integrity of our platforms and users. In the interest of saving everyone time, we encourage you to report vulnerabilities with these in mind:

  1. Ensure that you are using the latest, stable, and updated versions of the Operating System and Web Browser(s) available to you on your machine.
  2. We consider using tools & online utilities to report issues with SPF & DKIM configs, SSL Server tests, etc., in the category of "beg bounties" and are unable to respond to these reports.
  3. While we do not offer any bounties or swags at the moment, we'll be happy to list your name in our Hall of Fame list, provided the reports are not low-effort.

Reporting

After confirming the above guidelines, please feel free to send an email to possible-security-issue [at] freecodecamp.org. You can also send us a PGP encrypted message at flowcrypt.com/me/freecodecamp.

Once you report a vulnerability, we will look into it and ensure that it is not a false positive. If we need to clarify any details, we will get back to you. You can submit separate reports for each issue you find. Please note that we will not be able to respond to any issues that we think are outside the guidelines.

Platforms & Codebases

Here is a list of the platforms and codebases we are accepting reports for:

Learn Platform

VersionBranchSupportedWebsite active
productionprod-currentYesfreecodecamp.org/learn
stagingprod-stagingYesfreecodecamp.dev/learn
developmentmainNo

Publication Platform

VersionSupportedWebsite active
productionYesfreecodecamp.org/news
localizedYesfreecodecamp.org/<language>/news

Mobile App

VersionSupportedWebsite active
productionYeshttps://play.google.com/store/apps/details?id=org.freecodecamp

Other Platforms

Apart from the above, we are also accepting reports for repositories hosted on GitHub under the freeCodeCamp organization.

Other Self-hosted Applications

We self-host some of our platforms using open-source software like Ghost & Discourse. If you are reporting a vulnerability, please ensure that it is not a bug in the upstream software.

There aren't any published security advisories

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Security: BSolonenko/freeCodeCamp
Security

docs/security.md

freeCodeCamp.org's Security Policy
This document outlines our security policy for the codebases, platforms that we operate, and how to report vulnerabilities.
Reporting a Vulnerability
Note
If you think you have found a vulnerability, please report it responsibly. Do not create GitHub issues for security issues. Instead, follow this guide.
Guidelines
We appreciate responsible disclosure of vulnerabilities that might impact the integrity of our platforms and users. In the interest of saving everyone time, we encourage you to report vulnerabilities with these in mind:
  1. Ensure that you are using the latest, stable, and updated versions of the Operating System and Web Browser(s) available to you on your machine.
  2. We consider using tools & online utilities to report issues with SPF & DKIM configs, SSL Server tests, etc., in the category of "beg bounties" and are unable to respond to these reports.
  3. While we do not offer any bounties or swags at the moment, we'll be happy to list your name in our Hall of Fame list, provided the reports are not low-effort.
Reporting
After confirming the above guidelines, please feel free to send an email to possible-security-issue [at] freecodecamp.org. You can also send us a PGP encrypted message at flowcrypt.com/me/freecodecamp.
Once you report a vulnerability, we will look into it and ensure that it is not a false positive. If we need to clarify any details, we will get back to you. You can submit separate reports for each issue you find. Please note that we will not be able to respond to any issues that we think are outside the guidelines.
Platforms & Codebases
Here is a list of the platforms and codebases we are accepting reports for:
Learn Platform
VersionBranchSupportedWebsite active
productionprod-currentYesfreecodecamp.org/learn
stagingprod-stagingYesfreecodecamp.dev/learn
developmentmainNo
Publication Platform
VersionSupportedWebsite active
productionYesfreecodecamp.org/news
localizedYesfreecodecamp.org/<language>/news
Mobile App
VersionSupportedWebsite active
productionYeshttps://play.google.com/store/apps/details?id=org.freecodecamp
Other Platforms
Apart from the above, we are also accepting reports for repositories hosted on GitHub under the freeCodeCamp organization.
Other Self-hosted Applications
We self-host some of our platforms using open-source software like Ghost & Discourse. If you are reporting a vulnerability, please ensure that it is not a bug in the upstream software.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: BSolonenko/freeCodeCamp
Security

docs/security.md

freeCodeCamp.org's Security Policy
This document outlines our security policy for the codebases, platforms that we operate, and how to report vulnerabilities.
Reporting a Vulnerability
Note
If you think you have found a vulnerability, please report it responsibly. Do not create GitHub issues for security issues. Instead, follow this guide.
Guidelines
We appreciate responsible disclosure of vulnerabilities that might impact the integrity of our platforms and users. In the interest of saving everyone time, we encourage you to report vulnerabilities with these in mind:
  1. Ensure that you are using the latest, stable, and updated versions of the Operating System and Web Browser(s) available to you on your machine.
  2. We consider using tools & online utilities to report issues with SPF & DKIM configs, SSL Server tests, etc., in the category of "beg bounties" and are unable to respond to these reports.
  3. While we do not offer any bounties or swags at the moment, we'll be happy to list your name in our Hall of Fame list, provided the reports are not low-effort.
Reporting
After confirming the above guidelines, please feel free to send an email to possible-security-issue [at] freecodecamp.org. You can also send us a PGP encrypted message at flowcrypt.com/me/freecodecamp.
Once you report a vulnerability, we will look into it and ensure that it is not a false positive. If we need to clarify any details, we will get back to you. You can submit separate reports for each issue you find. Please note that we will not be able to respond to any issues that we think are outside the guidelines.
Platforms & Codebases
Here is a list of the platforms and codebases we are accepting reports for:
Learn Platform
VersionBranchSupportedWebsite active
productionprod-currentYesfreecodecamp.org/learn
stagingprod-stagingYesfreecodecamp.dev/learn
developmentmainNo
Publication Platform
VersionSupportedWebsite active
productionYesfreecodecamp.org/news
localizedYesfreecodecamp.org/<language>/news
Mobile App
VersionSupportedWebsite active
productionYeshttps://play.google.com/store/apps/details?id=org.freecodecamp
Other Platforms
Apart from the above, we are also accepting reports for repositories hosted on GitHub under the freeCodeCamp organization.
Other Self-hosted Applications
We self-host some of our platforms using open-source software like Ghost & Discourse. If you are reporting a vulnerability, please ensure that it is not a bug in the upstream software.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: BSolonenko/freeCodeCamp
Security

docs/security.md

freeCodeCamp.org's Security Policy
This document outlines our security policy for the codebases, platforms that we operate, and how to report vulnerabilities.
Reporting a Vulnerability
Note
If you think you have found a vulnerability, please report it responsibly. Do not create GitHub issues for security issues. Instead, follow this guide.
Guidelines
We appreciate responsible disclosure of vulnerabilities that might impact the integrity of our platforms and users. In the interest of saving everyone time, we encourage you to report vulnerabilities with these in mind:
  1. Ensure that you are using the latest, stable, and updated versions of the Operating System and Web Browser(s) available to you on your machine.
  2. We consider using tools & online utilities to report issues with SPF & DKIM configs, SSL Server tests, etc., in the category of "beg bounties" and are unable to respond to these reports.
  3. While we do not offer any bounties or swags at the moment, we'll be happy to list your name in our Hall of Fame list, provided the reports are not low-effort.
Reporting
After confirming the above guidelines, please feel free to send an email to possible-security-issue [at] freecodecamp.org. You can also send us a PGP encrypted message at flowcrypt.com/me/freecodecamp.
Once you report a vulnerability, we will look into it and ensure that it is not a false positive. If we need to clarify any details, we will get back to you. You can submit separate reports for each issue you find. Please note that we will not be able to respond to any issues that we think are outside the guidelines.
Platforms & Codebases
Here is a list of the platforms and codebases we are accepting reports for:
Learn Platform
VersionBranchSupportedWebsite active
productionprod-currentYesfreecodecamp.org/learn
stagingprod-stagingYesfreecodecamp.dev/learn
developmentmainNo
Publication Platform
VersionSupportedWebsite active
productionYesfreecodecamp.org/news
localizedYesfreecodecamp.org/<language>/news
Mobile App
VersionSupportedWebsite active
productionYeshttps://play.google.com/store/apps/details?id=org.freecodecamp
Other Platforms
Apart from the above, we are also accepting reports for repositories hosted on GitHub under the freeCodeCamp organization.
Other Self-hosted Applications
We self-host some of our platforms using open-source software like Ghost & Discourse. If you are reporting a vulnerability, please ensure that it is not a bug in the upstream software.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Security: BSolonenko/freeCodeCamp
Security

docs/security.md

freeCodeCamp.org's Security Policy
This document outlines our security policy for the codebases, platforms that we operate, and how to report vulnerabilities.
Reporting a Vulnerability
Note
If you think you have found a vulnerability, please report it responsibly. Do not create GitHub issues for security issues. Instead, follow this guide.
Guidelines
We appreciate responsible disclosure of vulnerabilities that might impact the integrity of our platforms and users. In the interest of saving everyone time, we encourage you to report vulnerabilities with these in mind:
  1. Ensure that you are using the latest, stable, and updated versions of the Operating System and Web Browser(s) available to you on your machine.
  2. We consider using tools & online utilities to report issues with SPF & DKIM configs, SSL Server tests, etc., in the category of "beg bounties" and are unable to respond to these reports.
  3. While we do not offer any bounties or swags at the moment, we'll be happy to list your name in our Hall of Fame list, provided the reports are not low-effort.
Reporting
After confirming the above guidelines, please feel free to send an email to possible-security-issue [at] freecodecamp.org. You can also send us a PGP encrypted message at flowcrypt.com/me/freecodecamp.
Once you report a vulnerability, we will look into it and ensure that it is not a false positive. If we need to clarify any details, we will get back to you. You can submit separate reports for each issue you find. Please note that we will not be able to respond to any issues that we think are outside the guidelines.
Platforms & Codebases
Here is a list of the platforms and codebases we are accepting reports for:
Learn Platform
VersionBranchSupportedWebsite active
productionprod-currentYesfreecodecamp.org/learn
stagingprod-stagingYesfreecodecamp.dev/learn
developmentmainNo
Publication Platform
VersionSupportedWebsite active
productionYesfreecodecamp.org/news
localizedYesfreecodecamp.org/<language>/news
Mobile App
VersionSupportedWebsite active
productionYeshttps://play.google.com/store/apps/details?id=org.freecodecamp
Other Platforms
Apart from the above, we are also accepting reports for repositories hosted on GitHub under the freeCodeCamp organization.
Other Self-hosted Applications
We self-host some of our platforms using open-source software like Ghost & Discourse. If you are reporting a vulnerability, please ensure that it is not a bug in the upstream software.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: BSolonenko/freeCodeCamp
Security

docs/security.md

freeCodeCamp.org's Security Policy
This document outlines our security policy for the codebases, platforms that we operate, and how to report vulnerabilities.
Reporting a Vulnerability
Note
If you think you have found a vulnerability, please report it responsibly. Do not create GitHub issues for security issues. Instead, follow this guide.
Guidelines
We appreciate responsible disclosure of vulnerabilities that might impact the integrity of our platforms and users. In the interest of saving everyone time, we encourage you to report vulnerabilities with these in mind:
  1. Ensure that you are using the latest, stable, and updated versions of the Operating System and Web Browser(s) available to you on your machine.
  2. We consider using tools & online utilities to report issues with SPF & DKIM configs, SSL Server tests, etc., in the category of "beg bounties" and are unable to respond to these reports.
  3. While we do not offer any bounties or swags at the moment, we'll be happy to list your name in our Hall of Fame list, provided the reports are not low-effort.
Reporting
After confirming the above guidelines, please feel free to send an email to possible-security-issue [at] freecodecamp.org. You can also send us a PGP encrypted message at flowcrypt.com/me/freecodecamp.
Once you report a vulnerability, we will look into it and ensure that it is not a false positive. If we need to clarify any details, we will get back to you. You can submit separate reports for each issue you find. Please note that we will not be able to respond to any issues that we think are outside the guidelines.
Platforms & Codebases
Here is a list of the platforms and codebases we are accepting reports for:
Learn Platform
VersionBranchSupportedWebsite active
productionprod-currentYesfreecodecamp.org/learn
stagingprod-stagingYesfreecodecamp.dev/learn
developmentmainNo
Publication Platform
VersionSupportedWebsite active
productionYesfreecodecamp.org/news
localizedYesfreecodecamp.org/<language>/news
Mobile App
VersionSupportedWebsite active
productionYeshttps://play.google.com/store/apps/details?id=org.freecodecamp
Other Platforms
Apart from the above, we are also accepting reports for repositories hosted on GitHub under the freeCodeCamp organization.
Other Self-hosted Applications
We self-host some of our platforms using open-source software like Ghost & Discourse. If you are reporting a vulnerability, please ensure that it is not a bug in the upstream software.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: BSolonenko/freeCodeCamp
Security

docs/security.md

freeCodeCamp.org's Security Policy
This document outlines our security policy for the codebases, platforms that we operate, and how to report vulnerabilities.
Reporting a Vulnerability
Note
If you think you have found a vulnerability, please report it responsibly. Do not create GitHub issues for security issues. Instead, follow this guide.
Guidelines
We appreciate responsible disclosure of vulnerabilities that might impact the integrity of our platforms and users. In the interest of saving everyone time, we encourage you to report vulnerabilities with these in mind:
  1. Ensure that you are using the latest, stable, and updated versions of the Operating System and Web Browser(s) available to you on your machine.
  2. We consider using tools & online utilities to report issues with SPF & DKIM configs, SSL Server tests, etc., in the category of "beg bounties" and are unable to respond to these reports.
  3. While we do not offer any bounties or swags at the moment, we'll be happy to list your name in our Hall of Fame list, provided the reports are not low-effort.
Reporting
After confirming the above guidelines, please feel free to send an email to possible-security-issue [at] freecodecamp.org. You can also send us a PGP encrypted message at flowcrypt.com/me/freecodecamp.
Once you report a vulnerability, we will look into it and ensure that it is not a false positive. If we need to clarify any details, we will get back to you. You can submit separate reports for each issue you find. Please note that we will not be able to respond to any issues that we think are outside the guidelines.
Platforms & Codebases
Here is a list of the platforms and codebases we are accepting reports for:
Learn Platform
VersionBranchSupportedWebsite active
productionprod-currentYesfreecodecamp.org/learn
stagingprod-stagingYesfreecodecamp.dev/learn
developmentmainNo
Publication Platform
VersionSupportedWebsite active
productionYesfreecodecamp.org/news
localizedYesfreecodecamp.org/<language>/news
Mobile App
VersionSupportedWebsite active
productionYeshttps://play.google.com/store/apps/details?id=org.freecodecamp
Other Platforms
Apart from the above, we are also accepting reports for repositories hosted on GitHub under the freeCodeCamp organization.
Other Self-hosted Applications
We self-host some of our platforms using open-source software like Ghost & Discourse. If you are reporting a vulnerability, please ensure that it is not a bug in the upstream software.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Security: BSolonenko/freeCodeCamp
Security

docs/security.md

freeCodeCamp.org's Security Policy
This document outlines our security policy for the codebases, platforms that we operate, and how to report vulnerabilities.
Reporting a Vulnerability
Note
If you think you have found a vulnerability, please report it responsibly. Do not create GitHub issues for security issues. Instead, follow this guide.
Guidelines
We appreciate responsible disclosure of vulnerabilities that might impact the integrity of our platforms and users. In the interest of saving everyone time, we encourage you to report vulnerabilities with these in mind:
  1. Ensure that you are using the latest, stable, and updated versions of the Operating System and Web Browser(s) available to you on your machine.
  2. We consider using tools & online utilities to report issues with SPF & DKIM configs, SSL Server tests, etc., in the category of "beg bounties" and are unable to respond to these reports.
  3. While we do not offer any bounties or swags at the moment, we'll be happy to list your name in our Hall of Fame list, provided the reports are not low-effort.
Reporting
After confirming the above guidelines, please feel free to send an email to possible-security-issue [at] freecodecamp.org. You can also send us a PGP encrypted message at flowcrypt.com/me/freecodecamp.
Once you report a vulnerability, we will look into it and ensure that it is not a false positive. If we need to clarify any details, we will get back to you. You can submit separate reports for each issue you find. Please note that we will not be able to respond to any issues that we think are outside the guidelines.
Platforms & Codebases
Here is a list of the platforms and codebases we are accepting reports for:
Learn Platform
VersionBranchSupportedWebsite active
productionprod-currentYesfreecodecamp.org/learn
stagingprod-stagingYesfreecodecamp.dev/learn
developmentmainNo
Publication Platform
VersionSupportedWebsite active
productionYesfreecodecamp.org/news
localizedYesfreecodecamp.org/<language>/news
Mobile App
VersionSupportedWebsite active
productionYeshttps://play.google.com/store/apps/details?id=org.freecodecamp
Other Platforms
Apart from the above, we are also accepting reports for repositories hosted on GitHub under the freeCodeCamp organization.
Other Self-hosted Applications
We self-host some of our platforms using open-source software like Ghost & Discourse. If you are reporting a vulnerability, please ensure that it is not a bug in the upstream software.
 There aren't any published security advisories