SafeExamOS
Talk to us

Secure exam labs on Linux, without surveillance

Lock the lab, not the student.

You set the contest, the room, and the start time. Once the exam begins, the lab handles enforcement and you can focus on student questions.

See how an exam runsCompare the options
  • No webcams
  • No screen recording
  • Runs on your own lab machines
An exam, coming together. 18 seconds.

How it works · I’m running the exam

Setting up a lab exam.

This traces CS 201’s second lab exam from the allowed-site list through to the final report. The panels are working examples you can explore.

  1. 01Set upMonday

    From contest code to allowed pages.

    You give SafeExamOS the platform and contest code (CodeChef START254, for example). It allows the pages for that specific contest, so practice problems, editorials, and discussions remain blocked.

    Example exam setupDraft
    Lab
    Lab A
    Exam window
    14:00–16:00
    CS201-roster.csv24 example students
    Lab-A-layout.svg24 seats, ready to assign

    Allowed sites

    • exam.example.eduAdded
    • docs.python.orgAdded
    • course.example.eduAdded

  2. 02SeatTuesday

    Seating that avoids previous neighbours.

    Seating comes from the roster and the lab layout. The arrangement is seeded and reproducible. It moves each person away from their previous machine and their previous neighbours. Shuffle it here and pick a seat to follow.

    CS 201 / Lab A

    Example seating plan
    Course roster24 example students
    Allowed sites3 sites

    Select a seat to follow.

    Front of lab
    Seat C4Example student 16Assigned

  3. 03Run14:12

    What the live view shows.

    During the exam, the view shows seat status rather than screen content: which machines are ready, which need attention, and how many requests were blocked. Spare seats are locked as well, so moving a student to a different machine takes a minute.

    Lab A: 21 of 24 seats signed in · 1 needs attention

    14:12:08

    Front of lab

    Seat C4
    Signed in 13:58
    Blocked requests
    17
    Incidents
    0
    • Signed in
    • Waiting
    • Needs attention
    • Offline

  4. 04Review16:05

    Submissions traced to assigned seats.

    After the exam, each submission on the judge can be matched to a request from the student’s assigned machine. In one course audit, sixteen submissions listed as missing turned out to be compile errors, all logged from the correct seats within a second.

    Example exam report

    CS 201 / Lab exam 2

    Lab A 14:00–16:00

    14:02:31docs.python.orgAllowed
    14:03:12github.comBlocked
    14:41:07exam.example.edu/submitSubmitted
    Seat C4Judge submissions matched to this seat: 3 of 3
    Lab A is back to everyday use.Example end state: exam rules ended, lab restored.
    16:00

The same setup works for both lab exams and contests. CodeChef, DOMjudge, and Moodle quizzes have all run under SafeExamOS.

Read the FAQ

What it doesn’t do

We lock the network. We do not watch the room.

Most exam software treats the student as the threat and points a camera at them. SafeExamOS treats the lab as the problem to solve. Some things are permanently off the table.

Read the anti-roadmap
  • Webcam feedsThe camera is never switched on, streamed, or saved.
  • Screen recordingScreen contents are never captured or recorded.
  • Keystroke loggingStudent keystrokes are not recorded.
  • Microphones and room audioThe microphone is never on.
  • AI “suspicion scores”No automated model scores or rates student behaviour.
  • Face recognition and biometricsNo face matching, ID photos, or biometric templates.

Compared with

The usual ways to lock down an exam.

Each of these is the right answer somewhere. Here is where SafeExamOS fits among them.

Lockdown browser

Safe Exam Browser

Free and mature. Locks the browser, not the network. No Linux client.

How it comparesRoll your own

Blocker extensions and DIY scripts

Free and yours entirely. Easy to set up, easy to work around, and often only one person understands how it all works.

How it comparesRemote proctoring

Remote proctoring

The only option that works for home exams. It works by watching the student, and that has costs.

How it comparesClassroom monitoring

Classroom monitoring

Good teaching tools. As exam tools, they come down to someone watching a wall of screens.

How it compares

From the lab

How real exams have gone.

All user stories
Data structures in C, at an engineering institute

239 students, four labs, one contest.

239 students sat a DOMjudge exam across four labs at once. The proxy logs came to 231,433 lines and were uneventful, which was the point.

Students
239
Labs
4
Weekly CodeChef contest, four labs

The night the clocks were five and a half hours fast.

Fifty-three machines began showing security warnings mid-contest. The cause was a Windows time setting on dual-boot machines. The fix ran across all 259 machines before the contest ended.

Students
228
Machines affected
53
Data structures exam: a CodeChef contest plus a Moodle quiz

Sixteen missing submissions, all explained.

An audit flagged sixteen submissions that did not match the lab logs. Each one was a compile error, sent from the correct seat within a second of the timestamp.

Students
54
Flagged submissions
16

Privacy, briefly

What gets recorded, and what never does.

All privacy questions
Does SafeExamOS record students?

Not in the way most exam software does. There is no webcam, no microphone, and no screen recording, and there never will be. This is listed on the anti-roadmap, which makes it an explicit commitment rather than just current practice.

SafeExamOS records network traffic from the lab machine: the address of each request it makes during the exam, whether it was allowed or blocked, and when. Together with the seating plan, that tells you which seat made which requests. The log says nothing about the student beyond their seat number.

Can it see what I type or what’s on my screen?

No. SafeExamOS does not capture keystrokes, the clipboard, screenshots, or the contents of pages. It cannot see the code in your editor or the answers you type into a quiz. The proxy checks which addresses are permitted and writes each request’s address to a log.

Does it look inside HTTPS traffic?

On lab machines during an exam, partly. When a lab is locked, each machine trusts a certificate that SafeExamOS created locally on that machine. This lets the local proxy see the full URL of an HTTPS request, including the path after the domain.

This makes fine-grained rules possible. You can allow one CodeChef contest while blocking the rest of CodeChef, or allow a LeetCode problem page while blocking the editorial. For LeetCode, the filter also checks what kind of request a page is making (problem or editorial) to decide whether to allow it.

The log records addresses and decisions. It does not record page contents, form data, or anything you submitted. When the lab is restored, the proxy is switched off.

So the log shows when I submitted?

It shows that a request was sent from your seat to the judge’s submit endpoint at a particular time. Your instructor can compare that against the judge’s own record of submissions to verify that exam submissions came from the lab. It does not contain your code.

Some courses use this to set a simple policy: submissions made outside the lab during the exam window are treated as practice rather than as an exam attempt. Your course will tell you if that applies.