Bill Demirkapi - Are Your Child's Records at Risk? The Current State of School Security
A high school student discovers unauthenticated API endpoints exposing millions of K-12 student records from major edtech platforms.
Summary
Edtech API Security Failures
Bill Demirkapi, a high school student at the time of research, presents critical vulnerabilities discovered in two major K-12 educational technology platforms serving millions of students.
Revel Systems: Unauthenticated Student Data Access
The Revel Systems parent portal API exposes student schedules, grades, teacher information, and disciplinary records for all students at connected schools through unauthenticated REST endpoints — accessible by simply incrementing student IDs.
PowerSchool: SQL Injection in SIS
PowerSchool, the dominant student information system in US K-12 schools, contains SQL injection vulnerabilities in authenticated endpoints that allow any school employee with login credentials to extract the full district database, including PII for students, parents, and staff.
Ethical Disclosure Journey
Demirkapi walks through his disclosure experience as a minor, including vendor non-responses, legal threats, and eventually coordinating disclosure through the school district, providing a candid account of responsible disclosure challenges.
Related talks
Mobile Village·25 min
Bogdan Tiron
Examines authorization and access control vulnerabilities in GraphQL and REST APIs, using the Feeld dating app data leak as a case study in data exposure.
Main Stage·35 min
Eaton Zveare · R Piyush
Reveals critical API authorization vulnerabilities in automotive dealer management systems that allowed national admin account creation and remote vehicle control.
Main Stage·34 min
Omer Attias
Omer Attias dissects API vulnerabilities in popular mobile transit payment apps like Moovit, demonstrating fare evasion and passenger PII data leakage.