Enforced browser isolation
Our production Content Security Policy blocks eval, plug-in objects, untrusted form targets, and unauthorized framing while constraining scripts, connections, media, and workers.
Security
Security you can feel.
You trust us with your account, your work, and sometimes your payment details. We treat that trust as the product itself — and engineer for it on every request, in every layer.
Security engineering · 2026
New protections, live by default.
These controls are built into the website, service tier, delivery pipeline, and production workload boundary—not left as optional operational steps.
Distributed abuse controls
Shared limits follow a user across application instances. Paid AI has per-client and global ceilings, a daily budget, request-size limits, and a production fail-closed circuit breaker.
Isolated workloads
Production workloads run as non-root with read-only filesystems, dropped Linux capabilities, PID limits, no privilege escalation, seccomp, and narrowly scoped writable volumes.
Continuously scanned supply chain
CodeQL scans JavaScript, TypeScript, and Go. Every web change runs type, lint, test, build, and production dependency gates; release dependencies are held above known patched versions.
Short-lived action links
Sensitive editorial links are action-bound, expire after 24 hours, never mutate on GET, require a deliberate POST confirmation, and are delivered with no-store and no-referrer protections.
Reward integrity controls
Hardened game-result paths use strict schemas and distributed per-user limits, while quest and XP progression is independently throttled so replaying result submissions cannot rapidly farm rewards.
TLS 1.2+
Encryption on every request
Zero
Passwords stored when you use a passkey
24/7
Automated abuse monitoring
PCI L1
Payments handled by Stripe
Our commitment
Security isn't a feature. It's the foundation.
How we keep you safe
Protection at every layer.
Real controls, not slogans. Here is what actually stands between a threat and your data.
Encrypted in transit
Every byte you exchange with RMH Studios travels over TLS. HTTP Strict Transport Security tells your browser to connect securely and never fall back, so downgrade attacks get nowhere.
TLS · HSTSPasswordless, phishing-resistant sign-in
Sign in with a passkey and there is no password to steal, phish, or leak. Prefer a provider? Use Google, Discord, or GitHub. Sessions live in hardened, HTTP-only cookies.
Passkeys · OAuth 2.0We never see your card
Payments run through Stripe, certified to PCI DSS Level 1. Your card details go straight to Stripe over an encrypted channel — they never touch, and never rest on, our servers.
Stripe · PCI DSS L1Defense in depth
An enforced Content-Security-Policy, strict security headers, server-side SSRF guards, distributed abuse limits, and schema-validated writes contain mistakes before they become breaches.
Enforced CSP · Distributed limitsPrivacy is the default
We collect the minimum we need to run the product, we never sell your data, and you can export or delete it whenever you want. Fewer things to protect is safer for everyone.
Data minimizationWatched around the clock
Abuse detection, model-spend circuit breakers, brute-force throttling, dependency scanning, and security audit logs continuously surface unusual activity.
Monitoring · Supply chainBuilt around your account
Your account, locked down.
The strongest security is the kind you never have to think about. These protections are on by default.
Passkeys & WebAuthn
Your device's secure enclave proves it's you with Face ID, Touch ID, or a hardware key. The secret never leaves your device — there is nothing on our side to breach.
Trusted single sign-on
Sign in with Google, Discord, or GitHub and lean on the accounts — and two-factor protection — you already use every day.
Hardened sessions
Session tokens sit in Secure, HTTP-only, SameSite cookies that scripts can't read and other sites can't ride. On HTTPS they are marked Secure automatically.
Brute-force resistant
Sign-in, sign-up, and password-reset endpoints are individually rate-limited to shut down credential stuffing and password guessing.
Encrypted at rest
Your data lives in managed databases and object storage that are encrypted at rest, with access restricted by the principle of least privilege.
You're always in control
Change your handle, export your data, or delete your account on your terms — and sign out of your sessions whenever you want.
How signing in works
Three ways in — all of them hardened.
However you choose to sign in, the goal is the same: prove it’s you without ever creating something an attacker can steal.
Passkeys (WebAuthn)
The strongest option, and the one we recommend. Your device creates a key pair; the private key never leaves its secure enclave, and you unlock it with Face ID, Touch ID, or a hardware key. There is no shared secret to phish, guess, or leak — and nothing on our side that a breach could expose.
Social sign-in
Sign in with Google, Discord, or GitHub over OAuth 2.0. You lean on an account you already protect (and its own two-factor), and we only ever receive the profile fields we need — never your password with that provider.
Email & password
If you use a password, it is hashed with a modern, salted algorithm and stored only in that form — we can never read it back. Sign-in, sign-up, and reset are each rate-limited to stop credential stuffing.
Session cookies
Your session lives in a cookie that is HTTP-only (JavaScript can’t read it), SameSite (other sites can’t ride it), and marked Secure over HTTPS. Requests are checked against an allow-list of trusted origins.
Brute-force limits
Auth endpoints are throttled per window: sign-in and sign-up at 10 attempts a minute, password reset at 6 — loose enough for a real typo, tight enough to shut down guessing.
Defense in depth
Layer by layer.
No single control is a silver bullet, so we stack them. This is what actually runs between a threat and your data on every request.
In transit
Everything runs over TLS. HTTP Strict Transport Security is sent with a one-year max-age and includeSubDomains, so browsers refuse to talk to us insecurely — no downgrade, no first-request window.
Security headers
X-Content-Type-Options: nosniff, a strict Referrer-Policy, X-Permitted-Cross-Domain-Policies: none, and a Content-Security-Policy that pins who may frame us. They’re applied at the edge and re-applied at the app layer, so no serving path is left uncovered.
SSRF protection
Any time the server fetches a URL you gave us (link previews, image proxy, webhooks) it goes through a guard that resolves DNS, rejects private and reserved IP ranges, allows only HTTPS, and re-validates every redirect hop — closing DNS-rebinding and redirect bypasses.
Input validation
Every write is validated against a strict schema before it touches the database. Malformed or oversized input is rejected at the door, not somewhere deep in the stack.
Constant-time secrets
Internal and webhook secrets are compared in constant time, so an attacker can’t recover them a byte at a time by measuring how long a check takes.
Safe file handling
Uploads are validated by their actual bytes (not a claimed extension), re-encoded, and stored under server-generated keys. File paths are resolved and confirmed to stay inside their directory, so “../” tricks go nowhere.
Your data, your call
Privacy is a security feature.
The safest data is the data we never collected. What we do hold, we protect — and you stay in control of it.
- We collect the minimum we need to run the product — and we never sell your personal data.
- Your data is encrypted in transit with TLS and at rest in our managed databases and object storage.
- Access to production data is restricted by the principle of least privilege, and admin actions are recorded in a tamper-evident audit log.
- You can export your data whenever you want — it’s yours.
- You can delete your account and its data on your terms, not ours.
- We keep cookies to what the product needs; the details live in our Cookie Policy.
Bug bounty program
Break it. Get paid.
Security is a team sport, and researchers are on our team. Report a real, original vulnerability and we'll reward it — up to $5,000,000 for the most serious findings, with eligible security-hardening reports starting at $100.
Critical$500,000–$5,000,000
A break that could compromise the platform itself or its users at scale.
Remote code execution on production infrastructure · full authentication bypass · mass account takeover · extraction of the production database or platform secrets.
High$50,000–$500,000
Serious access to data or systems you shouldn't be able to reach.
SQL/command injection · SSRF reaching internal services or cloud metadata · stored XSS in another user's session · IDOR exposing another user's private data · privilege escalation to admin · payment or entitlement manipulation.
Medium$5,000–$50,000
A real flaw with a meaningful, but bounded, impact.
CSRF on sensitive actions · reflected XSS · authorization gaps with limited scope · open redirects usable for phishing · rate-limit bypasses that enable abuse.
Low$25–$5,000
A genuine issue with a realistic, if narrow, path to harm.
Self-XSS with a credible escalation · low-impact information disclosure · security misconfigurations with a demonstrated effect.
Informational$100–$1,000
A useful, original hardening observation without a demonstrated exploit path.
A reproducible security hygiene improvement · a narrow information leak with no sensitive content · a defense-in-depth gap that helps prevent future vulnerabilities.
What each vulnerability is worth
| Category | Up to | What qualifies |
|---|---|---|
| Remote code execution | $5,000,000 | Run arbitrary code on RMH Studios production servers. Needs a working proof-of-concept that does not rely on already-compromised credentials. |
| Authentication bypass / account takeover | $5,000,000 | Sign in as another user or defeat our passkey / OAuth / session checks without their help. Zero-click and reproducible at scale reaches the top of the range. |
| Broken access control / IDOR | $500,000 | Read or change another user's private data or resources by manipulating identifiers. The reward scales with the sensitivity and volume of data reached. |
| Server-side request forgery (SSRF) | $500,000 | Coerce our servers into requests to internal services or cloud metadata. You must demonstrate reaching a genuinely non-public target. |
| Injection (SQL / command) | $500,000 | Inject into a database or shell through unsanitised input, with a PoC that reads or alters data you shouldn't be able to reach. |
| Stored cross-site scripting (XSS) | $500,000 | Achieve persistent script execution in another user’s session. Provide the payload and the exact page it fires on. |
| Payment / entitlement manipulation | $500,000 | Obtain paid features, coins, or subscriptions without paying, or change another user's balance or entitlements. |
| Sensitive data / secret exposure | $500,000 | Expose secrets, tokens, or other users’ personal data. Report the exact endpoint and stop — never exfiltrate data at scale. |
| CSRF / reflected XSS | $50,000 | Force a state-changing request cross-site, or reflect script execution from a request parameter. Include a working exploit page. |
| Open redirect & phishing vectors | $50,000 | Redirect our users to an attacker-controlled destination from a trusted rmhstudios.com URL. |
| Defense-in-depth / security hardening | $1,000 | Show an original, reproducible improvement that reduces real security risk but does not yet provide an exploit path. Eligible acknowledgements start at $100. |
In scope
- rmhstudios.com and its subdomains
- Our public API, developer platform, and web apps
- Authentication, payments, and how we handle your data
Out of scope
- Denial-of-service and volumetric attacks
- Social engineering, phishing our staff, or physical access
- Scanner output or missing headers with no proof-of-concept
- Issues in third parties (Stripe, Discord, cloud providers)
Rules of engagement
- Only ever test against your own account and data
- Never access, change, or destroy data that isn't yours
- Give us a reasonable window to fix before going public
- One clear, reproducible vulnerability per report
What happens next
From report to reward.
No black hole, no radio silence. Here’s exactly what happens after you hit submit.
- 1
Acknowledge
We confirm we’ve received your report within two business days — a real human, not an auto-responder that closes the loop.
- 2
Triage & validate
We reproduce the issue, confirm its impact, and set a severity. If we need more detail, we’ll ask; if it’s a duplicate or out of scope, we’ll tell you honestly and why.
- 3
Fix & verify
We patch it, verify the fix actually closes the hole (and doesn’t open another), and ship it. Critical issues jump the queue.
- 4
Reward & credit
Once it’s confirmed, we pay based on severity and demonstrated impact — from $100 for eligible hardening reports to $5,000,000 for exceptional critical findings — and, with your permission, add you to our thanks.
- 5
Disclose together
When you’re ready and the fix is live, we’re happy to coordinate public disclosure so your work gets the recognition it deserves.
Submit a report
Found a weakness? Tell us.
Send it straight to our security team below. We acknowledge every report within two business days, keep you posted through triage, and pay out once it's confirmed.
Questions, answered
The things people ask.
Do you support two-factor authentication?
A passkey is inherently multi-factor — it binds something you have (your device) to something you are (your biometric) — so it’s stronger than a password plus a texted code. If you sign in with Google, Discord, or GitHub, any two-factor you’ve enabled there protects your RMH Studios account too.
Do you store my password?
If you use a passkey, there is no password anywhere — nothing to store or steal. If you use email and password, it’s salted and hashed with a modern algorithm and stored only in that irreversible form; we can never read it back.
Is my payment information safe?
Your card details go straight to Stripe, which is certified to PCI DSS Level 1 — the highest tier. They never touch, and never rest on, our servers, so there is nothing here for an attacker to take.
Do you sell my data?
No. We never sell your personal data. We collect the minimum we need to run the product, and you can export or delete it at any time.
I found a bug that isn’t security-related. Where do I report it?
Use the in-app feedback tools for product bugs and ideas. This page and [email protected] are specifically for vulnerabilities — please keep those channels for issues that could put accounts or data at risk.