Floppaland · KianFloppa · Floppa Felony · Floppa Mining
🛡️ Security
How our four websites protect you, and the standards we hold every change to. No user accounts, no cookies, no advertising or analytics services, no outside scripts on our own pages, and every live feature is limited, checked and cleaned before anything reaches another player.
How we protect you
Encrypted, every time
Every page is only served over HTTPS. Browsers are told to never use an unencrypted connection to us again for a whole year, including all our subdomains, and any stray insecure link is upgraded automatically.
A strict Content Security Policy
Your browser only runs scripts that come from our own website. Outside scripts, plugins and foreign frames are blocked (the only frames allowed are the Twitch, Kick and YouTube players on the KianFloppa live page), data can only be sent back to us, and forms can only go to us. Before it went live, we opened all 356 pages in a real browser with the policy switched on: nothing was blocked.
Private by design
No cookies, no advertising and no third-party analytics or tracking services. Fonts, icons and images come from our own server, not from other companies. Our own visitor statistics are limited: they keep only totals, and to count a visitor once per day they use a rotating one-way checksum that is deleted every night, so nobody is recognised across days. Our host, Cloudflare, processes the technically necessary data to deliver and protect the sites (see the privacy policy). Game progress stays in your own browser.
Safe multiplayer rooms
Room passwords are salted and hashed, never stored readable. Wrong guesses are limited per person with a cooldown. Rooms, connections and unfinished joins are capped, also across all room names. Every chat message and catch is size-limited, slowed down if sent too fast, filtered, and shown as plain text only, so it can never run code. Empty rooms delete themselves.
Honest push notifications
Only the browsers' own official push services are accepted, nothing else. A notification carries no personal data and nobody can change its text: it only ever says that a real new update is out. Each update is sent once, one batch at a time, and the sending can be locked to our own release job. You can unsubscribe at any time.
Locked-down APIs
Every server endpoint accepts only the request types it needs and checks every input against strict allow-lists and size limits. Counters and live features have per-person rate limits and hard caps, so nobody can flood them, and they never keep more data than the feature needs.
No secrets in the code
Keys and tokens live only in encrypted secret stores, never in the code. The code lives in private, version-controlled repositories, and every change to the websites is listed in the public website history.
A written rulebook
All four websites share one security rulebook that every change must follow: escape everything shown, validate everything received, limit everything public, keep the browser policy strict, and never store what isn't needed. New features are checked against it before they ship.
Checked, then checked again
We crawl every page in a headless browser to catch blocked resources, broken links and broken images, and we review the server code regularly, including AI-assisted security reviews whose findings are always checked against the real code before anything is changed.
Security headers on every page
Sent with every page of all four websites. You can check them yourself in your browser's developer tools (Network tab, Response headers).
Strict-Transport-SecurityHTTPS only for a year, subdomains included.Content-Security-PolicyOnly our own scripts, styles, images, fonts and connections; no plugins, no foreign frames, no outside form targets, insecure links upgraded.X-Frame-OptionsOther websites can't put our pages in a frame (protects against clickjacking).X-Content-Type-OptionsFiles are only used as what they really are (no MIME sniffing).Referrer-PolicyOther sites only see that you came from us, never the full address.Permissions-PolicyCamera, microphone, location, payments, USB, serial, Bluetooth and ad-interest tracking are switched off.Cross-Origin-Opener-PolicyPages opened from other sites can't reach into ours.X-Permitted-Cross-Domain-PoliciesOld plugin cross-domain access is refused.Standards we follow
We build against public, widely used standards. These are the ones our rulebook is based on.
Honest limits
There are no user accounts and no payments on these websites, so there are no account passwords or card details here to steal. Floppaland is bought on the store's own checkout. Multiplayer fishing rooms use separate room passwords, which are only stored as salted hashes.
Our policy still allows inline scripts that are part of our own pages, because the sites use them for their games and tools. Outside scripts stay blocked. Moving to fully script-hashed pages is on our list.
The KianFloppa live page embeds the Twitch, Kick and YouTube players, which load content from those services (and their own cookies) inside their frames. Only those three are allowed, and only on that site. Everything else on all four websites comes from our own server.
Found a problem?
Please tell us privately first: [email protected] with the subject Security. Describe what you found and how to reproduce it.
- Please don't test on other players, don't flood the servers and don't read other people's data.
- Give us a reasonable time to fix it before you share it.
- If you like, we'll thank you by name in the website history once it's fixed.
Machine-readable contact: security.txt (RFC 9116).