Security in Markshles School uses layered controls and shared responsibility. The current platform includes application-level protections designed to reduce common web and account-security risks.

Implemented security controls

• **Secure authentication and password storage:** passwords are stored using PHP's secure password hashing APIs and verified with the corresponding password verification mechanism.
• **CSRF protection:** state-changing forms use cryptographically generated CSRF tokens with server-side validation.
• **XSS mitigation:** dynamic output is HTML-escaped through the platform's output helper when rendered in application views.
• **SQL injection mitigation:** database access uses PDO prepared statements with native prepares enabled (`ATTR_EMULATE_PREPARES = false`) for parameterized queries.
• **Login rate limiting and lockouts:** failed login attempts are recorded and configurable email/IP thresholds can trigger temporary blocks and progressive delays.
• **Clickjacking protection:** the application sends `X-Frame-Options: SAMEORIGIN`.
• **Browser security headers:** the application also sends `X-Content-Type-Options: nosniff`, a strict-origin referrer policy and a restrictive Permissions Policy.
• **Cloudflare Turnstile / CAPTCHA:** Cloudflare Turnstile is supported as a configurable anti-spam and anti-abuse control with server-side token verification. Google reCAPTCHA v2 is also supported where configured.
• **Session protections:** successful authentication regenerates the session identifier and configurable idle/absolute session expiration policies are available.
• **Security blocks and audit information:** IP/email blocks and login-attempt records support investigation and access protection.
• **Roles and permissions:** school and platform permissions restrict administrative actions according to authorized roles.

These controls reduce risk but do not make any internet-connected system immune from attack. Internet outages, upstream hosting incidents, DNS failures, malicious traffic, credential theft, phishing, ransomware, malware, denial-of-service attacks and newly discovered vulnerabilities can affect online services despite reasonable safeguards.

Markshles may perform emergency maintenance, patches, temporary restrictions or other protective actions when a security or stability risk is identified. Customers must use strong credentials, limit privileges, promptly deactivate unnecessary accounts, protect their devices and networks, and report suspected incidents.

For customer-managed Dedicated hosting, server hardening, operating-system updates, firewall, backups, monitoring and infrastructure security remain the customer's responsibility unless a written managed-service agreement assigns specific duties to Markshles.

Security obligations, incident notification and data-processing responsibilities may be further defined by contract and applicable law. See the Terms of Service, Privacy Policy and Data Protection pages for additional information.