Before LearnLoop could run inside SUTD's learning platform, it had to go through EduTech's cybersecurity review.
Keeping the course where it already was
I started with classmates downloading lecture slides and pasting questions into chatbots. I wanted them to ask a question and get an answer with the relevant slide beside it, without uploading the same files again.
In faculty conversations, lecturers asked how LearnLoop would handle grade reports, quizzes and the courses they had already organised. I had built it around students, but lecturers needed those parts too.
I kept LearnLoop inside eDimension, SUTD's Blackboard LMS, so lecturers could keep their existing courses and students could open the tutor from the same place.
Using the university's login
The original setup had its own accounts and public signup. For the university launch, I removed the extra signup step and used SUTD's EASE login through LTI 1.3, the standard that lets teaching tools connect to an LMS.
A student signs into eDimension and opens LearnLoop from their course. LearnLoop validates that launch and creates a session for the right user and course. I also reduced the LMS access it requested to what the tutor needed.
LearnLoop passed SUTD EduTech's first cybersecurity review after those login and access changes.
Making the handoff work only once
The university login still had to become a LearnLoop session. I used a random code that expires after 60 seconds. The browser exchanges it in a POST request, so the session token does not travel in a URL.
Expiry alone is not enough. A code could be reused several times before its minute is up. The exchange deletes the stored code and returns its session data in the same database operation, using PostgreSQL's DELETE ... RETURNING. Two requests cannot both claim it: the first removes the row, and the second finds nothing.
The tests cover the first exchange, a repeated exchange, an expired code and a malformed payload. An expired attempt removes the stored data too.
Back to the student's question
LearnLoop was piloted with 40 students across two SUTD classes. Students can ask about their course material and open the lecture page behind an answer, without uploading the slides themselves.
