---
number: 28
title: The security audit — the box, the code and the client hardened before launch
date: 2026-09-13
summary: A full audit of the game server, the Builder, the area server, the client and the droplet, three days before store submission — twenty-seven findings, every one patched and verified live the same day, from a link that could have run a stranger's script on the site to a service user with root and areas listening on the open internet.
epic: server-instance
status: delivered
artifacts: ["docs/handoff/security-audit.md","ops/droplet/README.md","ops/droplet/apply-hardening.sh"]
cta: [object Object]
---

With the store builds on their way, Kris asked for the whole platform to be audited as an
attacker would see it — the server code, the admin service, the area processes, the phone and
browser clients, and the actual machine — and for everything realistic to be fixed. Three
independent reviews of the code, a read-only inspection of the droplet, the cloud and GitHub
settings, and an external scan produced twenty-seven findings. All were patched and deployed
on 2026-09-13, with the live checks run against production afterwards.

## What was found

Three were the kind a stranger could use with one link: a game-page parameter that would run
any website's script as spellgrove.com, with every stored token in reach; another that pointed
the game at any server and handed it the player's session; and an authoring route that ran
uploaded JavaScript on the box. Behind those, the box's service user could become root without
a password, every area listened on the public internet in plaintext, one account could spawn
game processes without limit, sessions never expired, and the admin service held the game
database's full credential.

## What changed

Two unprivileged service users now run everything network-facing, each inside a systemd
sandbox; the areas answer only through the front door; the machine takes daily database dumps,
installs its security updates at three in the morning Brisbane time and reboots itself for a
new kernel; a cloud firewall stands beside the one on the box; access logs, security headers
and body limits sit on every request. Sessions expire after ninety idle days and a player can
sign out another device. The Builder reads the game through roles that cannot see a password
hash. The test accounts whose password was in the repository were deleted and remade with a
secret.

## What a player notices

Almost nothing, by design. A device that has not opened the game in ninety days signs in again
— silently on a phone. The realm has a size for the first time: twelve areas at once on
today's box, and a join that would start a thirteenth is told the realm is full and to try
again shortly. That limit is a rail, not a plan; measuring what an area really costs, so the
number can be set from evidence, is the next piece of server work.