Join
Why Join
Research Research overview Learn Experiments Analyze Pilot 📝 Research Papers 👥 Groups 📖 Research Team Handbook
Teams
Help 🎓 Student Guide 🧭 Coordinator Guide 📖 Research Team Handbook 📄 Documents ⚡ Ask Thunder
Ask
Fun 🎴 Arcade Games 😂 Memes
🌓 Light / dark mode Sign In Join

Security Policy

Last updated: October 31, 2026

Rainflower.World is a research platform for school students, many of them under 18. Their names, schools, research and raindrop balances live on this site, and keeping that safe matters more to us than almost anything else we do. If you think you have found a security problem, we want to hear about it, and we will treat you as a helper, not a threat.

This page explains how to report a problem, what we promise in return, and the rules we ask you to follow so that no student is harmed while you look. Our machine-readable contact file is at /.well-known/security.txt.

1. How to report a problem

Email kabir@evoknow.com with "Security" in the subject line. Please include:

  • The page or address where the problem is (for example https://rainflower.world/...)
  • What the problem is, and what someone could do with it
  • The steps to see it happen, with screenshots or a short video if they help
  • Your name or handle, if you would like to be thanked

Please do not put passwords, sign-in links or anyone else's personal information in your email. If we need more detail that is sensitive, we will arrange a safer way to share it.

2. What we promise

  • We will reply within 5 business days to say we have your report.
  • We will tell you whether we can reproduce the problem and how serious we think it is, and keep you updated until it is fixed.
  • We aim to fix serious problems within 30 days, and sooner when student data is at risk.
  • We will tell you when the fix is live.
  • With your permission, we will thank you by name in our change log when the fix ships.

3. What is in scope

  • rainflower.world and its subdomains
  • The Rainflower website and everything signed-in members can reach: accounts, profiles, research groups, papers, the blog, quizzes and arcade games, raindrops and rewards, and the admin and coordinator tools

Problems we especially want to hear about:

  • Seeing or changing another member's information, especially a student's
  • Signing in as someone else, or getting coordinator, advisor or admin powers you should not have
  • Creating, moving or spending raindrops in ways the rules do not allow
  • Running code in another person's browser (cross-site scripting) or on our server
  • Getting past our content checks to show harmful material to students

4. What is out of scope

  • Services run by other companies that we use, such as email delivery, YouTube, X or WhatsApp. Please report those to the company that runs them.
  • Attacks that need physical access to someone's device, or a device that is already compromised
  • Tricking, phishing or pressuring our members or staff
  • Denial-of-service, flooding, or spam
  • Reports from automated scanners without a real, demonstrated impact
  • Missing security headers, cookie flags or email (SPF/DMARC) settings, unless you can show how they lead to real harm
  • Self-XSS, or problems that only appear in out-of-date browsers

5. Rules for testing

Our members are young people. While you test, please:

  • Only use accounts you own. Do not sign in to, view, change or delete anyone else's account or work.
  • Stop as soon as you see someone else's personal information. Do not copy, keep or share it, and tell us what you saw in your report.
  • Never contact our students as part of your testing, on this site or anywhere else.
  • Do not keep or spend raindrops, rewards or anything else you gain through a bug. Report it, and we will reverse it.
  • Do only what you need to show the problem exists. Do not slow the site down for others or run heavy automated scans.
  • Do not upload or post content that is harmful, adult or offensive, even as a test.
  • Keep the problem private until we have fixed it and agreed with you that it can be shared. If we have not fixed it within 90 days, let us know before you publish so we can talk it through.

6. Safe harbor

If you follow this policy in good faith, we will consider your research authorized. We will not take legal action against you or ask anyone else to, and we will not close your Rainflower account because of your report. If someone else complains about research you did under this policy, we will make clear that you were acting within it.

This does not cover actions that break the rules above, harm our members, or break the law.

7. For Rainflower students and members

If you are a student and something on the site looks wrong (for example, you can see another student's private information), you will never get in trouble for telling us honestly. Stop what you are doing, do not show it to anyone else, and email kabir@evoknow.com or tell your coordinator.

8. Rewards

We are a small youth research program and do not run a paid bug bounty. We are grateful for every report, and we will thank you publicly if you would like us to.

9. Other questions

This address is only for security problems. For help with your account, privacy requests or general questions, write to info@rainflower.world or use the support page. How we handle personal information is explained in our Privacy Policy.