# WYG Security Summary — Illinois Pilot

**Status:** Diligence summary; not a certification or independent audit  
**Updated:** August 23, 2026  
**Security contact:** wygplaybookapp@gmail.com

## Operational reliability controls

- Public application/database health endpoint suitable for an independent five-minute uptime monitor.
- Explicit Cloudflare Workers observability plus structured 5xx and exception events carrying non-sensitive request IDs.
- D1-backed route-specific rate limits, account lockout, hashed abuse subjects, and operations-access denial events.
- Coach-visible, exportable program audit trail for access, roster, content, test, privacy, and grading actions.
- Secret-protected operational readiness endpoint that remains unavailable until the production secret is configured.
- Cloudflare D1 Time Travel as the provider-managed automatic database recovery layer, plus a scheduled restore-point check and an isolated migration/export/restore drill.
- Locked dependencies, scheduled security/quality checks, dependency-audit gate, Dependabot configuration, and private vulnerability-reporting policy.
- Written operational, backup/recovery, monitoring, production-access, incident-response, and NIST SSDF alignment procedures.

Provider-account settings, external alert recipients, source-host security features, R2 object recovery, named operators, and a timed production-account recovery test remain activation gates before student launch.

## Architecture and data boundary

WYG is a server-rendered web application deployed through OpenAI Sites on Cloudflare infrastructure. Structured records use Cloudflare D1 and private source files use Cloudflare R2. Every team record carries a program boundary and authenticated requests are checked against active membership and role.

## Identity and access controls

- WYG-owned team-scoped usernames and six-digit PINs; athletes do not need a third-party AI account.
- Salted password-derivation for credentials; session, invitation, and recovery tokens stored as one-way hashes.
- Temporary lock after repeated failed sign-ins.
- Expiring, single-use, revocable, role-scoped invitations.
- Revocable sessions and one-time recovery codes.
- Coach ability to deactivate an athlete and invalidate active sessions.
- Role separation for program owner, coach, and athlete actions.

## Testing integrity

- Active athlete test payloads omit official signals, formations, route geometry, coaching points, and complete concepts.
- Grading is performed on the server from immutable play snapshots.
- Attempts record the test identifier/version and answers record the play identifier/version.
- Published test content is not edited in place; later changes create a new version.
- Original answers and server scores remain preserved when a coach later adjudicates a disputed drawing.

## Data protection

- Program-scoped authorization on roster, playbook, test, result, message, upload, and privacy operations.
- Private upload delivery only after authorization; untrusted upload content is served with restrictive browser headers.
- Administrative audit events for sensitive changes and privacy requests.
- Input validation, bounded fields, one-time tokens, and server ownership checks.
- TLS is required by the hosted production origin; storage protection relies in part on the contracted hosting providers' controls.

## Operational procedures

WYG maintains draft export/deletion, retention, incident, and support procedures in the School Data Controls packet. A school can immediately export its program record in JSON; an owner can create a reviewed deletion request. Security incidents are triaged, contained, documented, and communicated to the School under the signed breach timeline.

## Current limitations and pre-pilot gates

The pilot must not be represented as independently certified. Before live student data, WYG must activate and evidence the controls that depend on external accounts or people: individual least-privilege operator access and MFA; secret rotation; GitHub dependency alerts/security updates; production uptime and error alert recipients; D1 backend/recovery-window verification; R2 source-file recovery; a timed recovery drill; incident tabletop; deletion completion/certificate; retention enforcement; service-provider contracts; and an external security review appropriate to pilot scope. Any open high-severity finding blocks launch.

## School responsibility boundary

The School controls authorized users, roster fields, instructional content, notices, pilot scope, and retention instructions. WYG controls the Service's technical safeguards and its personnel/providers. The School should not upload health records, government identifiers, financial information, biometrics, precise location, or unrelated academic records.

## Reporting

Report suspected unauthorized access, exposure, vulnerability, or misuse to wygplaybookapp@gmail.com with the program name, reporter contact, time observed, and a factual description. Do not include student data in an unencrypted email unless necessary; WYG will establish a safer exchange channel when needed.