Security

How we protect WallRush

• Every page and app connection uses HTTPS, and our domain tells browsers to always use it (HSTS).
• Passwords are stored only as secure hashes by our authentication provider. We never see them.
• Database rules let each player read and change only their own private data; shared data (leaderboards, matches) changes only through checked server functions.
• Forms and in-app actions are rate-limited, and our forms are protected against bots.
• Administrator access is limited to named staff, protected with two-factor authentication, and every moderation action is logged.
• We keep the code that runs in your browser to what’s needed, and set strict browser security rules (Content Security Policy).

Reporting a vulnerability

If you think you’ve found a security problem in WallRush, please tell us privately at security@wallrush.io. Include:

• what you found and where (URLs, app version);
• the steps to reproduce it;
• what an attacker could do with it.

Please don’t: access, change or delete other players’ data; disrupt the service (no denial-of-service or load testing); use automated scanners that send large amounts of traffic; or share the problem publicly before we’ve fixed it.

We will: confirm we received your report within 3 business days, keep you updated, credit you if you’d like once it’s fixed, and not take legal action against good-faith research that follows these rules.

We don’t currently run a paid bug bounty.

Machine-readable contact details are at /.well-known/security.txt.