Confidential Challenges, Protected by Design
Companies often share sensitive problem statements. Mindova is built to keep that information access-controlled at every step.
NDA-Gated Access
Companies can require contributors to sign a non-disclosure agreement before viewing a challenge brief, attachments, or task details. Signing status is tracked per challenge and enforced server-side, not just hidden in the UI.
Two-Factor Authentication
Any account can enable TOTP-based 2FA. Secrets and recovery codes are stored encrypted, never in plain text, and recovery codes are single-use.
Role-Based Access Control
Contributors, companies, and internal team members each see only what their role permits — enforced by middleware on every request, not just hidden navigation links.
Token-Based API Auth
API access uses Laravel Sanctum personal access tokens scoped to the authenticated user, with the ability to revoke tokens at any time from account settings.
Private File Storage
Challenge attachments are stored on access-controlled storage and served only through an authorized download endpoint — never via a public, guessable URL.
Audit Logging
Sensitive administrative actions inside the internal Mindova team console are logged for accountability and review.
Found a Security Issue?
We take security reports seriously. If you've found a vulnerability, please report it privately so we can investigate and fix it before any public disclosure.
Report a Vulnerability