Security

Found a problem? Please tell me

If you find a security or privacy problem in the game, the website or the API, email support@tahurgame.com with how to reproduce it. I'll reply within a few days, keep you posted, fix it as fast as I can, and credit you if you'd like.

Please test only with your own accounts; don't access or change other players' data, don't degrade the service for others (no load testing or denial of service), and give me a reasonable time to fix it before telling anyone else. Research done in good faith under these rules is welcome, and I won't take action against it.

How players are protected

• Accounts: no passwords to steal. Device keys are random and stored only as one-way hashes; email sign-in stores only a keyed hash of the address; passkeys keep their private key on your device. Sign-in codes expire in ten minutes and allow five tries.
• Fair online play: the server runs every duel and is the only one that knows the shoe and the hidden cards; each player is sent only what they're allowed to see. Ranked tables level every kit, so an edited save buys nothing, and repeated results between the same two accounts stop counting for rating.
• Abuse: rate limits on every request, a proof-of-work check before anything is created, message limits on game connections, and a name filter for what other players see.
• The website: HTTPS everywhere with HSTS, a strict Content-Security-Policy, no cookies, and no third-party scripts apart from Cloudflare's cookieless analytics, which is loaded with an integrity check.
• Data: as little as possible, deleted on a schedule (see the privacy policy), and backed up so a mistake can be undone.

Machine-readable contact: /.well-known/security.txt