Security

Found a vulnerability?

Please write to security@example.com, in English or German, with what you found and how to reproduce it. We confirm within a few working days and tell you what we do about it. Please don't access, change or delete other people's data, and don't disrupt the service; test with accounts and games of your own. We don't pay bounties, but we will thank you, by name if you like. We will not take legal action against research done in good faith along these lines. Machine-readable: /.well-known/security.txt.

What we do

• Every connection is encrypted (HTTPS); so are the ones to the mail service and, in production, the database.
• No passwords: sign-in links work once, for 15 minutes, and are stored only as a hash.
• You can see and end every sign-in of your account.
• Every page and script comes from our own server, under a strict content security policy.
• Every access to a deck, card or photo checks that it is yours.
• Uploads are re-encoded by a separate service that has no connection to the internet and no access to storage.
• Photos are never public; game codes have 6 characters and guessing them is limited.
• Sign-in, mails, new games, uploads and exports are limited against abuse.
• Our logs hold no IP addresses, e-mail addresses or tokens.
• The servers run without privileges, and in the cluster nothing may connect where it needn't.

What we don't claim

Photos are not end-to-end encrypted: our server has to read them to make cards. We have no certification. No service is free of faults; this is why we ask you to keep your originals.