xrooster

Our school used an app called Eduarte for schedules, but it was ugly, hard to log in and missed features we wanted such as offline mode, customizability and more. So a friend and I decided we should try to build our own app. We found that Eduarte didn't use any APIs but used server-side rendering instead. But we found that they got their schedule from another site called Xedule, and they did have undocumented APIs. With some browser devtools and a hacky login system it worked. While working on this project I also found a security vulnerability that allowed every student to see other students schedules and grades by just having their student email, which was very easy to find in Microsoft Teams. I reported this to the school and they fixed it in a couple of days.