Identity and access
WYG issues its own protected, revocable sessions, so athletes do not need a third-party AI account. Team members sign in with a team code, team-scoped username, and personal six-digit PIN protected with a salted password-derivation function. Five failed attempts trigger a temporary lock. Individual invitations are hashed, single-use, expiring, revocable, and role-scoped; athlete email is optional. Coaches can deactivate members and issue 30-minute, single-use recovery codes.
Playbook and testing controls
Athletes receive only the minimum information needed for the current rep. WYG uses hidden grading keys—including correct formations, route geometry, signals, coaching points, and complete concepts—that stay server-side until an attempt is graded. Each published test stores an immutable play snapshot, and each answer stores the exact answer key used for that score.
Trusted results
Attempts require a short-lived server-issued session. WYG verifies ownership, test status, due dates, retake rules, rep completeness, and session expiration before grading. Scores are calculated on the server and tied to an attempt, athlete, assignment, test identifier/version, and play identifier/version. Later coach adjudication is recorded without rewriting the original answer or score.
Data protection
Team data is program-scoped. Uploaded files are private and served only after authorization. Session, invitation, and recovery tokens are stored as one-way hashes. Administrative activity is recorded for accountability. Production changes are versioned and database migrations are reviewed before deployment.
Operational reliability
WYG exposes a minimal application/database health probe, enables Cloudflare Workers observability, adds non-sensitive request IDs to responses, records structured server failures, and maintains D1-backed rate limits for sensitive routes. Coaches receive a program-scoped audit trail with CSV export. A separate operations readiness endpoint is disabled until a protected production secret is configured.
Backup and recovery
Cloudflare D1 Time Travel is the automatic database recovery layer. WYG includes a daily restore-point verification workflow and a synthetic export/restore drill that applies every migration and checks a recovered integrity marker. Production account verification, alert recipients, R2 source-file recovery, and a timed recovery exercise remain launch gates.
Secure development baseline
Locked dependencies, scheduled security and quality checks, dependency-audit enforcement, Dependabot configuration, controlled release versions, and written vulnerability handling align WYG's pilot process with the four outcome groups in NIST SSDF 1.1. This is risk-based alignment, not a certification.
Incident response and reporting
Suspected vulnerabilities or data incidents should be reported to wygplaybookapp@gmail.com. WYG will validate the report, contain risk, preserve evidence, notify the School without unreasonable delay under the signed timeline, remediate the issue, and document follow-up actions.
School diligence
This summary is not an independent audit or certification. Least-privilege operator access, restore testing, retention enforcement, deletion certification, provider contracts, incident tabletop testing, and an appropriate external security review remain pre-pilot gates.
Security summary ↓Reliability runbook ↓Backup and recovery ↓Incident response ↓NIST SSDF ↗All school controls →