Security Issues

This page addresses some security concerns users might have with the game.

1. Privacy of Users and Sensitive Information

• Use strong authentication, like salting and hashing passwords.
• Players might choose simple passwords that are easy to guess. Fix would be to require strong passwords (letters, numbers, symbols).
• When sending and storing sensitive user data, make sure to encrypt it.
• Clearly tell players what information is being collected and why.
• Avoid showing real names, emails, or IPs publicly, keep that data private; only display usernames.
• Easy to guess room codes can let strangers join private games, make sure players can set a password.

2. Making sure the game is fair

• For all competitive or online actions, use server-side validation.
• Use checksums to make sure that saved files are still good. 3) Only give clients access to the data they need.
• Players could edit files to change decks, cards, pieces, etc. Fix would be to validate everything on the server; don’t let the client decide outcomes.
• People might change the game code to cheat, fix would be to keep logic on the server; only send display info to the player.
• To avoid multi-device ghosting where the same account sends conflicting actions, bind a match to one active session and reject concurrent inputs.

3. Security for code and dependencies

• Some libraries or plugins from other people may have security holes. The team will make sure that all dependencies are up to date.
• Before using any scripts from other people, they should be looked over and verified that they are safe.
• Don't show debugging tools or developer commands in release builds (except for grading purposes).

4. Safe deployment and upkeep

• When deployed online, the server infrastructure will use HTTPS, firewalls, and the least privilege principle for user roles. Regular audits will be planned to find weaknesses early on.
• Use firewalls and rate-limiting services to help avoid server overloads and fake traffic.
• Monitoring for cheating/anomalies, send alerts on absurd win times, impossible moves, repeated seq mismatches, or other suspicious activity.