Moodle vs Quizgecko

Moodle 67

Two credential models. The classic token is one secret per user and service with no scopes, documented in the wstoken query parameter, and the 5.3 personal access tokens and OAuth 2 clients carry scopes, expiry from 7 days to 1 year, one-time display and revocation; read as scoped tokens on part of the surface less 10 for the query-string option (18 of 30). Services limited to chosen functions and authorised users, capability checks in every function, IP restriction and valid-until on tokens; no confirmation step for destructive functions (16 of 20). Functions return forum posts, submissions and messages written by users, with no guidance on treating them as untrusted (5 of 15). Moodle logs web service calls in the site logs and 5.3 shows each personal access token's last use and IP; per-call detail wasn't read (10 of 15). security.txt valid to 10 May 2027, a Bugcrowd-linked report form, responsible disclosure with CVEs, advisories released on a schedule across supported branches, no paid bounty (18 of 20). 18 + 16 + 5 + 10 + 18 = 67.

Quizgecko 5

One bearer token per account with no scopes, expiry or rotation described, and ?api_key= is documented as a query-string option, so 10 less 10 (0 of 30). No read-only mode or confirmation for edits (0 of 20). The API fetches URLs and uploads the owner supplies and returns generated text; no guidance on treating fetched content as untrusted (3 of 15). GET /usage shows counts only, no per-call log (2 of 15). /.well-known/security.txt returned 404, the security page answered a Cloudflare challenge and no disclosure policy, bounty or certification was found elsewhere (0 of 20, with the security page unchecked). 0 + 0 + 3 + 2 + 0 = 5.

Moodle 80

Read with the local-software lines, since the owner runs Moodle and calls their own site. Official packages from moodle.org and GitHub with supported PHP and database versions stated per release, PostgreSQL 17 and MariaDB 11.4 and up for 5.3 (20). A public test suite (PHPUnit and Behat) and CI; whether the default branch was passing on 3 November was not read, since the repository's workflow pages weren't fetched (12 of 25). Bugs go to the Moodle Tracker, where security issues are triaged into dated advisories and point releases every two months carry fixes; the open bug count was not read (18 of 25). Versioned releases with release notes, upgrade notes and a written deprecation policy (15). Stable since 1.0 in 2002, now 5.3 (15). 20 + 12 + 18 + 15 + 15 = 80.

Quizgecko 20

Read with the hosted lines. No status page found, and status.quizgecko.com has no DNS record; the API catalogue links only a health endpoint that answered {"status":"ok"} (0). No readable incident history (5). No rate limit with numbers; the OpenAPI document lists a 429 and GET /usage reports a monthly course-creation limit, which is a quota, not a rate (5 of 15). No Retry-After, backoff guidance or idempotency keys, and generation is a write that creates a course each time (0). No SLA (0). V2 is the current API and is not marked beta (10). 0 + 5 + 5 + 0 + 0 + 10 = 20.

Moodle 60

Read with the self-hosted rule for free software with nothing to buy. No payment protocol (0 of 40). The licence is public and MoodleCloud's plan prices are public too (20). Free to download and run, with a 28-day MoodleCloud trial that needs no card (20). An owner installs it and issues their own tokens, so no vendor sign-up stands in the way (20). 0 + 20 + 20 + 20 = 60.

Quizgecko 15

No x402, MPP or L402 (0). App plan prices are public in llms.txt, but API access is "contact us" with no API price (5 of 20). A free app plan exists, but API access needs a request to the company and whether a card is needed could not be read (10 of 20). A person has to log in and ask for access (0). 0 + 5 + 10 + 0 = 15.

Moodle 76

GPL-3.0-or-later source (30). Privacy notice last updated October 2025 with a DPA and a GDPR register, no fixed retention periods, and for a self-hosted site the owner is the controller (18 of 30). A written deprecation policy with three stages tied to major versions and upgrade notes, plus a dated release and support calendar to 2029 (20). Sites may register with moodle.org and send statistics, and the AI subsystem names its providers; the privacy notice names no subprocessors or data locations (8 of 20). 30 + 18 + 20 + 8 = 76.

Quizgecko 35

Closed service. The terms page answered a Cloudflare challenge, so the entity and terms were read only from Companies House and the App Store (8 of 30). The privacy policy is disallowed by robots.txt and the security page is behind the challenge, so retention and data-handling statements are unread (0 of 30). V1 is called legacy and still served, with no date or policy (5 of 20). No subprocessors or data locations found on the readable pages (0 of 20). 8 + 0 + 5 + 0 = 13.

Moodle 81

Moodle 5.3.0 on 5 October 2026 and commits on main through 30 October (30). Point releases on 10 August, 14 September and 5 October 2026 across five branches (20). The Tracker, forums on moodle.org and developer chat answer issues; security issues were fixed and published with CVEs on 9 September, 22 September and 15 October 2026 (20 of 25). No official SDK or MCP server; sample clients only (5 of 15). PHPUnit and Behat suites, GitHub Actions, and minimum PHP and database versions raised per release, read from the release notes rather than a passing run (6 of 10). 30 + 20 + 20 + 5 + 6 = 81.

Quizgecko 55

Read for a closed service. The iOS app reached 8.0.1 on 27 October 2026 and llms.txt gives prices as of November 2026 (30). App versions on 27 August, 14 October, 24 October and 27 October 2026 (20). No API changelog; support@quizgecko.com in the docs metadata, untested (5 of 15). No SDKs (0). No package to judge (0). 30 + 20 + 5 + 0 + 0 = 55.