Account protection
- One central password rule across registration, account changes, admin changes and every reset route: 12–72 bytes with uppercase, lowercase and a number.
- Passwords are stored using bcrypt, never as readable passwords.
- Password changes and successful resets revoke every existing web and app session for that account.
- Reset links contain an opaque random token, expire after one hour, work once and are stored only as a SHA-256 token hash.
- Reset requests return the same response whether an address exists, with rate limits and a resend cooldown.
- State-changing web requests are protected by origin checks; authenticated sessions use secure, HTTP-only cookies.
Payments and delivery
Card entry and payment authorization are handled by Stripe. crazikktweaks does not receive or store a full card number. Purchase and refund webhooks are signature-verified and deduplicated before account or analytics state is changed.
Data minimisation
Persisted IP and HWID/SID values used for anti-abuse and licence matching are transformed into keyed, one-way HMAC pseudonyms. Normal Nginx access logging is disabled. A daily retention worker removes expired analytics, security, token, device and resolved-support data according to the public Privacy Policy.
Report a vulnerability
Email [email protected] with [SECURITY] in the subject. Include the affected URL/version, reproducible steps, impact and a safe proof of concept. Do not access other users' data, disrupt the service, run denial-of-service tests, spam reset/login routes or publish a live vulnerability before we can investigate.
Machine-readable contact: /.well-known/security.txt.