Security
Small boundaries, deliberate trust.
Idea2Play uses versioned static game packages in sandboxed frames, validates game-to-portal messages, keeps player services behind server-side sessions, and separates anonymous measurement from account, save, recovery, and feedback records.
Platform safeguards
- Released game URLs are immutable and versioned.
- Portal messages validate origin, frame source, protocol version, game ID, package version, and payload.
- Optional account cookies are essential, secure, HTTP-only sessions; games never receive account credentials.
- Input validation, request limits, rate limits, data minimization, cleanup, backup tests, and log redaction are part of the operating design.
Responsible disclosure
Use the private built-in feedback form and select Security. Describe the affected URL or game, the impact, and safe reproduction steps. Do not include passwords, passkeys, recovery codes, private save contents, challenge answers, or another person’s data unless essential. Do not disrupt the service or access data beyond what is needed to confirm the issue.
No guarantee
No online system is perfectly secure. The beta may change, pause, or be unavailable while issues are investigated. The Privacy Notice explains retained records and controls.