Deliverable #28 · 2026-09-13

The security audit — the box, the code and the client hardened before launch

With the store builds on their way, Kris asked for the whole platform to be audited as an attacker would see it — the server code, the admin service, the area processes, the phone and browser clients, and the actual machine — and for everything realistic to be fixed. Three independent reviews of the code, a read-only inspection of the droplet, the cloud and GitHub settings, and an external scan produced twenty-seven findings. All were patched and deployed on 2026-09-13, with the live checks run against production afterwards.

What was found

Three were the kind a stranger could use with one link: a game-page parameter that would run any website’s script as spellgrove.com, with every stored token in reach; another that pointed the game at any server and handed it the player’s session; and an authoring route that ran uploaded JavaScript on the box. Behind those, the box’s service user could become root without a password, every area listened on the public internet in plaintext, one account could spawn game processes without limit, sessions never expired, and the admin service held the game database’s full credential.

What changed

Two unprivileged service users now run everything network-facing, each inside a systemd sandbox; the areas answer only through the front door; the machine takes daily database dumps, installs its security updates at three in the morning Brisbane time and reboots itself for a new kernel; a cloud firewall stands beside the one on the box; access logs, security headers and body limits sit on every request. Sessions expire after ninety idle days and a player can sign out another device. The Builder reads the game through roles that cannot see a password hash. The test accounts whose password was in the repository were deleted and remade with a secret.

What a player notices

Almost nothing, by design. A device that has not opened the game in ninety days signs in again — silently on a phone. The realm has a size for the first time: twelve areas at once on today’s box, and a join that would start a thirteenth is told the realm is full and to try again shortly. That limit is a rail, not a plan; measuring what an area really costs, so the number can be set from evidence, is the next piece of server work.

Sources & artifacts

• docs/handoff/security-audit.md
• ops/droplet/README.md
• ops/droplet/apply-hardening.sh

← related epic: server-instance

Also available as raw markdown.