Security that can survive being explained

There is exactly one function in the codebase that builds what a candidate sees, and it selects the columns it sends explicitly rather than taking the whole question row and deleting the key from it. The difference is the entire safety property: deleting a field is one refactor away from becoming a copy that quietly restores it, and that failure is silent, total, and discovered when a cohort’s results turn out to be worthless. Grading reads the key in a different query, on the server, after the sitting is over.

The sitting records what the browser can honestly observe: focus lost and regained, fullscreen exited and re-entered, a blocked copy, a blocked paste, a blocked context menu. Sittings whose signals cross a threshold go to a review queue.

Nothing here voids an attempt on its own. That is a deliberate decision and it is the most important sentence on this page. A platform that voids on focus loss voids honest candidates with unreliable wifi, and the cost of that error — to the candidate, to your reputation, and in the appeal that follows — is far higher than the cost of a person looking at a pattern afterwards. Signals are evidence for a human decision, made with a reason the candidate reads, appealable to somebody who took no part.

This is also the argument against the industry’s current direction. Automated proctoring that flags a candidate for looking away, or for a face the model reads poorly, generates false accusations at a rate that certifying bodies are now being sued over. A signal that a person must interpret cannot do that.