Security

kova doesn’t use passwords. You sign in with a six-digit code we email you, or with Google or GitHub. A code expires after 10 minutes, stops working after five wrong tries, and only works in the browser that asked for it. We store only a hash of it. An email gets at most five codes an hour, so nobody can keep guessing.

When you sign in, kova creates a random 256-bit token. Your browser keeps it in a cookie that scripts on the page can’t read and that, on the live site, is only sent over HTTPS. The database stores only a SHA-256 hash of the token, so a copy of the database alone can’t be used to sign in as you. Sessions end after 30 days, or when you sign out.

Every change is checked on the server against who’s asking. Only a project’s team can edit it, only a hackathon’s judges can score it, and only its host can manage it.

If you find a security problem, email the team that runs this site with the steps to reproduce it. We’ll confirm we got your report and keep you posted while we fix it.

While you look into it, please don’t access or change other people’s data, disrupt the service, or share the details publicly until it’s fixed.