A note on auto-enroll and what happened

Recently we shipped an auto-enrollment feature for MacTrack. The idea was simple: connect your Mosaic session, and when a seat opens in a course you're watching, MacTrack enrolls you automatically. No more refreshing, no more missing the window.

The feature got attention on r/McMaster, and with that came legitimate questions about how we were handling student credentials.

Here's what we did with your data: your password was never stored. It was used once to generate a session cookie, then thrown away. That cookie was encrypted at rest using AES-256-GCM and only ever used for two things: checking if your session was still alive, and navigating to the Add Classes page when a seat opened. Grades, finances, personal info. None of that was ever touched.

That said, we hear the concern clearly: a session cookie grants broad Mosaic access in theory, and you had to trust us not to misuse it. We reached out to McMaster's Digital Trust and Governance team directly, before anyone else did. We sat down with them, walked through the technical implementation, and had a productive conversation.

As a result, we've taken down the auto-enroll feature and purged all stored session data. We're now working directly with McMaster IT on what a compliant version of this could look like down the road. We're not promising anything, but we're having the right conversations.

One more thing: course alerts are now free, unlimited, for everyone. No paywalls, no tiers. You shouldn't have to pay to know when a seat opens up.

MacTrack is built by McMaster students, for McMaster students. We're not going anywhere.