Security

Current safeguards

• HTTPS and restrictive browser security headers on production hosts.
• One-way password hashing, secure session cookies, session renewal, and shared authentication controls.
• CSRF protection, request origin validation, rate limiting, bot checks, and generic authentication errors.
• Upload extension, size, and content validation for normal Cloud accounts, plus path-containment checks for file access.
• Role checks around private and administrative routes, with security and authentication event logging.
• Public access blocked for configuration, backup, test, script, and operational artifact patterns.

Important limits

No security program eliminates all risk. Users should choose a unique password, protect their email account, sign out on shared devices, and keep independent backups of important files. GameEngine Studios does not claim that normal stored data is encrypted at rest.

Report a vulnerability

Use the Contact page and choose “Security report.” Include the affected URL, a clear description, safe reproduction steps, and your preferred contact method. Do not access other users’ data, degrade the service, use destructive testing, or publicly disclose an unresolved issue.

Response

Reports will be reviewed and prioritized according to potential impact. Acknowledgement and remediation timing depend on severity and the information available. Good-faith, non-destructive reports are appreciated.