Security

What's protected

• Sign-in and votes are signed plain messages with a single-use nonce that lasts 5 minutes, bound to this domain.
• The session cookie is host-only, HttpOnly, Secure and SameSite=Strict.
• Writes need an exact Origin. Each machine route takes its own secret, and those secrets can only write.
• Every write has a rate limit and a body size limit.
• Pages are escaped by default, and task text never reaches a page before it's screened.
• The site has a strict content policy with no inline scripts, no third-party scripts and no edge injection.
• The game is on its own address, sandboxed, with no network access.

Report a bug

Use a private advisory on GitHub. Say what you did and what you saw. Please don't post it publicly first.

There's no bounty.

Out of scope

• Load testing or denial of service.
• Attacks on GitHub, Cloudflare or anyone's wallet.
• Prompt injection through the task box is welcome on its own page, and it isn't a bug unless something got past the gate.

Check it yourself

The proof page has commands for every claim. security.txt has the contact.

Known limits are in the threat model.