What It Does
Instructors decide which Canvas assessments require SEB. Students receive a purpose-built, certificate-encrypted.seb configuration file. The Canvas access code for each protected assessment is released only after SEB proves it is running the current configuration — a server-verified Config Key proof, not a browser-UI check.
One deployment connects to one Canvas tenant and environment. Use separate service URLs, databases, secrets, LTI installations, and OAuth credentials for production, test, beta, or independent Canvas instances.
Safe Online Exam adds technical controls around a Canvas assessment. It does not replace instructional planning, identity verification, accommodations, device management, proctoring, incident response, or a school’s security and privacy review.
Who It Is For
The four groups that interact with Safe Online Exam have distinct responsibilities:What Version 1 Includes
- Canvas LTI 1.3 course navigation and root-account administration placements.
- Canvas OAuth with one durable per-user grant that carries the complete application scope set and upgrades in place for root-account administrators.
- Discovery and management of Classic Quizzes and New Quizzes.
- Course defaults, assessment overrides, start and exit passwords, URL rules, course exam tools, quiz-only tools, and school-managed tool presets.
- Certificate-encrypted
.sebfiles by default, with an explicit instance-level compatibility mode when managed certificate distribution is not possible. - Scoped Canvas session handoff into SEB without copying browser cookies.
- SEB Config Key proof, one-time access-code release, approved-tool release, and completion-bound exit.
- PostgreSQL-backed sessions, OAuth grants, settings, one-time state, admission limits, and distributed locks.
- Multi-architecture release images for
linux/amd64andlinux/arm64.
How The Protection Flow Works
The sequence below traces a student’s path from a Canvas course page to a completed SEB assessment. The enforcement boundaries are the generated SEB URL filter, the current configuration fingerprint, the server-side Config Key proof, and the Canvas-authored completion state — not the detector’s buttons or sidebar.Technology Stack
The runtime is provider-neutral: it requires PostgreSQL, a public HTTPS origin, secret injection, a migration job before application traffic, and scheduled cleanup. The two maintained deployment targets are Docker Compose and Google Cloud Run with Cloud SQL. Google Cloud Run with Cloud SQL is the recommended managed deployment; Docker Compose is the maintained self-hosted alternative.
Compatibility Contracts
Canvas and deployed SEB clients depend on the following stable public routes. Treat any change to these routes, content IDs, migrations, or configuration keys as a compatibility change that requires a versioned release.License
Safe Online Exam is source-available under the PolyForm Noncommercial License 1.0.0 — not an OSI-approved open-source license. Eligible institutions may self-host and modify it for permitted noncommercial use. Commercial hosting, implementation, support, resale, and competing services require separate permission. Review the commercial licensing document, contributing guide, third-party notices, and trademark guidance before redistribution or commercial use.Next Steps
Deployment Overview
Choose Docker Compose or Google Cloud Run and prepare your infrastructure before registering the application in Canvas.
Canvas Setup
Register the OAuth Developer Key, LTI Developer Key, and Canvas theme loader to connect Safe Online Exam to your Canvas tenant.
Configuration Reference
Review every environment variable, secret, and validation rule before your first deployed install.
Architecture
Understand the runtime shape, trust boundaries, identity model, SEB lifecycle, and persistence design.