Security
Your store holds your server’s name and your players’ purchases, so we protect it like a bank protects an account. Here is what we do, in plain words.
Accounts
Every account needs an authenticator app: you enter a code from it when you sign in on a new device. Recovery codes help if you lose your phone; each works once.
Passwords have at least 8 characters and are stored only as a salted scrypt hash, never in plain text. Unknown addresses and wrong passwords get the same answer, so nobody can find out who has an account.
Sessions
Sign-ins are kept on the server. The cookie in your browser cannot be read by scripts, is sent only to SMPHUB and only over HTTPS.
You see every signed-in device in your settings and can sign out one or all of them. A new password signs out every other device. Sessions end after a time without activity; for the SMPHUB team sooner.
Protection against attacks
Repeated guessing of passwords and codes is slowed down. Every changing request carries a token that other websites cannot know (CSRF protection).
The browser only runs SMPHUB’s own code (Content Security Policy), pages cannot be embedded elsewhere, and every connection uses HTTPS. Every input is checked on the server, and uploaded pictures are judged by their content, not their name.
Data and payments
We ask only for what we need. The application never asks for bank details or ID documents; Stripe asks for those when you set up your payout account.
Card details go to Stripe only. Secrets such as the codes of authenticator apps are stored encrypted. The database is backed up every night, and every backup is checked.
The SMPHUB team
The admin panel is not linked anywhere and can be limited to known networks. Team members only see what their rights allow, critical actions need a fresh code from the app, and every action of the team is written to a log that cannot be changed.
Found a problem?
If you think you have found a security problem, write to support@smphub.net. Please do not test it on other people’s stores or accounts. We answer every report.
Ready for your own store?
Applying is free, and our team reads every application.