Security & Architecture

Every page is prerendered to static HTML at build time. There is no application server, no database, no user sessions and no API that accepts input — the entire categories of bugs that plague dynamic apps (injection, broken access control, session theft) have nowhere to live.

There are no API keys in the client, no accounts, no passwords and no payment flows. An attacker studying the shipped JavaScript finds game logic and styling — nothing that unlocks anything else.

Pages are served over HTTPS by the hosting platform. Responses carry X-Content-Type-Options, X-Frame-Options: DENY, a strict Referrer-Policy and a restrictive Permissions-Policy (see next.config.mjs), and the X-Powered-By header is disabled.

Dependencies are pinned in package-lock.json, the framework is kept on patched releases (Next.js 15.5.x security backports), and npm audit findings are triaged — remaining advisories are build-time-only packages that never ship to browsers. Every change lands through reviewed pull requests with squash merges.

Game progress lives in same-origin localStorage, readable only by pages on this domain. The app never renders user input as HTML (the only inline scripts are our own structured-data JSON and a static theme snippet), keeping cross-site scripting with nothing to steal even if it occurred.

Found something that looks wrong? Please report it privately first via GitHub issues so we can fix it before details circulate. We will acknowledge, patch, and credit reporters who give us a fair chance to respond.