Account protection
Defense in depth
Password defense
Passwords are salted and deliberately expensive to verify. They are never stored in readable form.
Session rotation
Short-lived access tokens pair with rotating, revocable refresh sessions and reuse detection.
Optional 2FA
Authenticator secrets are encrypted, and one-time recovery codes are stored only as hashes.
Race-safe writes
Unique constraints, idempotency keys, leases, and compare-and-swap updates defend concurrent account operations.
Coordinated disclosure
Report vulnerabilities responsibly
Do not access another commander’s data, degrade the service, perform denial-of-service testing, send unsolicited bulk traffic, or publish an unmitigated vulnerability. Record the affected route, expected and observed behavior, prerequisites, and the smallest safe reproduction.
1Stop after confirmation. Do not expand access or retain data.
2Prepare minimal evidence. Remove credentials, tokens, personal data, and unrelated records.
3Use the help channel. Mark the report “Security disclosure” and allow reasonable time for investigation.
Scope
What we prioritize
Authentication bypass, cross-account access, session compromise, injection, unauthorized storage access, leaderboard forgery, multiplayer authority violations, and exposure of secrets or personal data receive priority. Cosmetic issues and reports produced only by obsolete browsers generally do not qualify as security vulnerabilities.