u/Educational-Set-4510

​I know everyone is stressed about the board results and the news about the 19-year-old hacking the digital checking portal (cbse.onmark.co.in) in 30 minutes. ​CBSE officially stated: "Don't worry, the hacker only accessed a testing/dummy website used in February. The real evaluation website is different and secure." ​I didn't just blindly trust the PR statement. I spent the last few days pulling server logs, Wayback Machine archives, and traffic data. Here is the unfiltered, ground-reality truth of what actually happened. The hacker was right, and here are the facts:

1. The "Practice" Site was holding our REAL data. CBSE says it was a dummy site for teachers to practice on. But the hacker proved with screen recordings that he saw real teacher emails, bank details, and high-res scans of real student answer sheets. Why? Because IT companies rarely type out millions of fake names to build a practice site. They just take a copy of the real, live official database and plug it into the practice website so the teachers have something realistic to test on. So yes, it was a "practice" site, but it was loaded with actual, highly sensitive data. ​2. The password was literally hardcoded in plain text. The hacker didn't use some insane dark-web tool to break in. The developers literally typed the "Master Password" directly into the frontend JavaScript code. Anyone who knows basic web-dev could press F12 (Inspect Element) in Chrome, read the code, and bypass the fake OTP screen. They put a clone of our real database on the public internet and locked it with a paper door. ​3. The Timeline proves it was running during the real exams. CBSE claimed this dummy site was only used for mock drills in February. I checked the Internet Archives (Wayback Machine). That exact vulnerable site—along with 5 mirror sites (cbse1 to cbse5.onmark.co.in)—was fully active and getting code updates in late March and early April. Why are you running an incredibly vulnerable "practice" site on the open internet right in the middle of the actual Class 12 board checking? ​Conclusion: Maybe the "official" main site is totally secure now. But the facts prove that they took real data, put it on an incredibly insecure practice server with zero backend security, and kept it running while the actual exams were happening. When the teenager went public in May, they panicked, nuked the practice domains (which is why reporters started getting 502 Bad Gateway errors), and released a PR statement saying "no real data was at risk." ​We aren't asking for a witch hunt, but as students, we deserve actual accountability and better digital infrastructure, not just PR cover-ups when a teenager exposes a flaw