Security & Responsible Disclosure
We take the safety of players and their data seriously. Last updated: 16 October 2026.
What we do
The game uses HTTPS everywhere, hashed sign-in tokens that expire, strict browser security headers, request limits against floods and brute force, server-side checks for every reward and purchase, and limited admin access.
Found a problem?
If you find a security problem, please tell us before you tell anyone else: open Help & Support (subject "Security") or use the Contact page. Please do not read or change other players' data, do not slow the service down, and give us reasonable time to fix it. We will not take action against people who report problems in good faith and follow these rules.
Not allowed
Attacking the service, scanning it with heavy tools, stealing data, social-engineering our players or staff, or selling bugs.
Thank you
We are happy to thank people who help us stay safe.