Security
Last reviewed .
Besides making games, we find cybersecurity fascinating, and we treat this site as a place to practice it. This page explains how the site is built and protected, and how to tell us about a problem.
In short
- The site is static files. There is no server code, database, CMS or login to attack.
- Every connection uses TLS 1.3, with post-quantum key agreement in browsers that support it.
- The site loads nothing from other sites and sets no cookies.
- Report security problems to security@severedsignal.com. Research that follows our policy is welcome and protected.
Reporting a problem
Please report security problems privately, never in public issues, on community platforms or on social media:
- Email security@severedsignal.com, encrypted with our PGP key below if you like. You don’t need a GitHub account.
- GitHub: open a private vulnerability report.
Our security policy explains what to include, what counts as a security problem and what to expect from us. It also gives safe harbor: if you follow it in good faith, we consider your research authorized and don’t take legal action against you. It covers our video games and this site. We’re a small studio and don’t run a bug bounty program.
The same contacts are in our security.txt, the standard file that tells researchers where to report (RFC 9116). It’s signed with our PGP key, so you can check it hasn’t been changed.
PGP key
Download the public key, or fetch it by address with gpg
--locate-keys security@severedsignal.com. Before you trust it, check that its fingerprint is:
C1B6 BBDB 2790 9C6F 6E6D 2D24 5C7F 0810 A91F 8A1D
- User ID: Severed Signal Studios <security@severedsignal.com>
- Type: Ed25519, with Curve25519 for encryption
- Expires:
How the site is built
severedsignal.com is plain HTML and CSS. Cloudflare stores the files and serves them directly, with no origin server behind it. The site accepts only requests to read a page, so there are no forms, uploads or logins.
With no server-side code, database or CMS, whole classes of attack don’t apply here, such as SQL injection and PHP or WordPress vulnerabilities. The pages run no JavaScript at all.
Encryption in transit
- The site accepts only TLS 1.3. Older versions are refused.
- Key agreement uses the post-quantum hybrid X25519MLKEM768 in browsers that support it, which helps protect traffic recorded today from being decrypted by future quantum computers.
- HTTP Strict Transport Security tells browsers to use only HTTPS for this site and its subdomains, for a year after each visit.
- The site is submitted to the HSTS preload list that browsers ship. Once it is accepted, browsers that carry the list use HTTPS from the first visit.
- DNS CAA records limit which certificate authorities may issue certificates for the domain.
Protection in your browser
Every response carries headers that tell your browser to limit what the page can do:
- A Content Security Policy that blocks everything by default, then allows only this site’s own styles, images and fonts. It allows no scripts at all, so nothing injected into a page could run.
- Cross-origin isolation, so other sites can’t frame these pages, embed their files or reach into the window.
- No referrer is sent when you follow a link, and the page can’t use your camera, microphone or location.
- Each page asks your browser to delete any cookies for the site. We set none ourselves.
Each page also carries a hash of the site’s stylesheet, a check called Subresource Integrity. Your browser refuses the stylesheet if it doesn’t match the hash.
Before every deploy, an automatic check stops the release if a page would break these rules or carries an out-of-date hash.
- SPF, DKIM and DMARC at
p=reject, so mail that only pretends to come from severedsignal.com is rejected. - MTA-STS in enforce mode, so mail to us is only delivered over encrypted, verified connections. TLS reporting tells us when delivery fails.
- BIMI, so supporting mail apps show our logo beside genuine mail from us.
How changes reach the site
- The site deploys only from its main branch, through a protected GitHub environment with a Cloudflare token that can change nothing but the site.
- Every GitHub Action is pinned to an exact commit, not a tag that could be moved.
- Dependabot proposes updates to those Actions, but waits seven days after each release, so a compromised release has time to be caught.
Scan results
We scan the site with third-party tools and rescan after changes:
- Snyk API & Web, a dynamic scan of the live site with the full profile, : no findings.
- Semgrep Code, a static scan of the site’s source, : no open findings. We fixed one and reviewed two as false positives.
Video games
Our games treat their save and settings files as untrusted input. Our security policy lists what counts as a security problem in a game. Report problems in a game engine itself to that engine’s developers.
Privacy
The site runs no analytics, ads or trackers. The privacy policy explains what data Cloudflare and we handle.
Changes
We review this page when the site’s setup changes, and update the date at the top.