Designed for trust. Honest about the limits.
Implemented controls and remaining validation. No external penetration-test or security-certification claim.
Access boundaries
Hosting requires native sign-in plus the room’s private bearer. Guest responses are filtered on the server so secret roles and hands are private. Account knowledge and preferences are scoped to the signed-in user. Workshop roles govern review and publishing. Invitation links never contain host control tokens.
Couples access
Single-use, expiring invitations store a hash; approval is required before custom prompts appear. Two approved participants confirm current shared settings. Codes, public display sessions, controller pairing and live lounges cannot unlock private couples play. Ending erases the room and revokes the two sessions.
Browser defenses
API responses are marked private/no-store. Cross-origin mutation requests are rejected. Browser headers restrict framing, prevent MIME sniffing, suppress referrers and limit device capabilities. These supplement authorization; they are not a full script restriction policy, WAF or traffic-abuse protection system.
Accountability
Credit grants and purchases use ledger controls. Room updates use revisions for concurrent actions. Reviewer publishing and lifecycle actions have role checks and audit records. Couples choices are excluded from platform feedback. Secrets stay server-side.
Before a wider launch
Independent security testing, production rate limiting and abuse monitoring, a monitored incident channel, incident response drills, dependency review, verified backups and restoration, retention cleanup and provider due diligence still need operator ownership. Do not submit security secrets into game prompts or public reviews.