Security

Your account

• Passwords are stored only in hashed form.
• Sign-in and registration are rate limited against password guessing.
• Every form on the site is protected against forged requests, and all database access uses prepared statements.
• Use a password you do not use anywhere else, and never share it: the team will never ask for it.

The servers

• The website and the game connection go through Cloudflare, encrypted (HTTPS) and protected against attacks.
• The database, the internal game servers and all admin tools are not reachable from the internet. Admin functions only work on the server machine itself.
• Donations are handled by PayPal; card details never reach us.

Reporting a problem

If you find a security issue, please tell us privately at [email protected] before telling anyone else.

• Only test with your own accounts and characters.
• Do not try to take the server down, and do not access or change other players' data.
• We will answer within a few days and thank you on the blog once it is fixed, if you want.