Developer security practices

01Hosting

We run on a major cloud provider in the US. All traffic uses modern encrypted connections, and our data has backups and protection against accidental deletion.

02Containers

Our services run with the fewest permissions possible and only accept traffic from approved sources. Automated checks confirm this on every change.

03Access

Each part of the system can only reach the data it needs, nothing more.

04Encryption

Data is encrypted in transit and at rest. Sensitive keys and secrets get an extra layer of encryption. Stronger encryption options are being added.Planned

05Secrets

Passwords, tokens and secrets are kept in a secure vault, never in code. Sign-in codes and tokens are stored in a scrambled form, so they cannot be read back.

06Network

Our internal systems are closed off from the public internet and need their own credentials to talk to each other. Further hardening is planned.Planned

07Keys and signing

Your phone creates its own sign-in key. Games get their own keys, and we only keep the public half. Every request from a game is signed and checked, and replayed requests are rejected. Extra key checks are planned.Planned

08Logging

Our logs never contain sign-in codes, tokens, keys or health data. Debug features cannot run in production.

09Revocation

When you remove a game's access, it is cut off within about a minute.

Found something? Email security@staminabar.io.