Security, enforced by the database
Row-level security in plain language — what it means, what it stops, and why interface hiding is not a security strategy.
The problem with “you don’t see that button”
Many student tools protect data by hiding things in the interface: the marks you should not see simply do not appear on your screen. That is not security — it is decoration. If the underlying data can still be read by a curious visitor with the right request, the interface was never the wall. Real protection has to live where the data lives.
What nuSkor does instead
The portal uses row-level security — database rules that decide, for every single request, which rows of data the requesting account may read or change. The rules are attached to the data itself, so they apply no matter how the request arrives: the normal interface, a mis-typed address, or a hand-crafted call.
In practice: a student’s requests can read their own marks, their own bookings and their own profile — and nothing belonging to anyone else. A teaching assistant can read and write the courses and sections they run, and no more. The administrator role is narrow and explicit. Every policy is attached to a signed-in identity, and public pages cannot query portal data at all.
The privacy implications, spelled out
- No name-and-score walls. The leaderboard is built on top of the same rules, and exposes anonymised entries — the strictest interpretation of “see yourself, not others” the data allows.
- Staff access is scoped, not universal. Being a TA for one section does not grant a window into the whole course — the rules follow your role and your section.
- Calculators are a separate world. Public tools run entirely in your browser. Nothing you type into them reaches any server, which means there is nothing to leak even in principle.
The other layers
Database rules sit in the middle of a wider arrangement: sign-in through Google (so nuSkor never handles passwords), HTTPS for everything in transit, a strict separation between public pages and portal pages, and one deliberate boundary that surprises nobody twice — no advertising scripts, cookies or units are ever loaded on sign-in, admin or portal pages. Ads belong to the public side of the site only, because private pages contain private student data.
No system is beyond review, ours included. If you are a security-minded reader and you spot something worth improving, write to the contact address — corrections and responsible reports are genuinely welcome.
| Data | Student | TA | Admin |
|---|---|---|---|
| Own marks | ✓ | — | — |
| Others' marks (own section) | ✗ | ✓ | ✓ |
| Own evaluation booking | ✓ | — | — |
| Section bookings roster | ✗ | ✓ | ✓ |
| Course announcements (read) | ✓ | ✓ | ✓ |
| Ad / tracking scripts | ✗ | ✗ | ✗ |
Simplified for readability — the real matrix is enforced by database policies attached to every row.
Frequently asked questions
Does nuSkor store my password?
Can a TA from another course see my marks?
Do the calculators send my data anywhere?
What if I find a security issue?
Track your real marks and book evaluation slots on nuSkor.
The portal is free for students: the marks your instructors publish, class statistics, a privacy-conscious ranking and evaluation slot booking — all in one place.