How we protect your account
Security & privacy
Built for a technical audience, so here is the real detail: exactly how accounts, passwords, and requests are handled, and the precautions baked into the code. No hand-waving, and nothing claimed that isn't actually in place.
Accounts & passwords
- Sign-in runs on Netlify Identity (GoTrue). Passwords are hashed with bcrypt on their servers and stored only as that hash - the site's own code never receives, logs, or stores your plaintext password.
- New passwords must be at least 8 characters and pass a strength check (a mix of at least three of: lowercase, uppercase, digit, symbol; common and repeated passwords are rejected). A live meter enforces it in the create-account dialog, and the same rule is re-checked on the server before the account is created - so it holds even if someone bypasses the browser.
- Prefer not to manage a password at all? Google and GitHub OAuth are offered, so you can sign in with an identity you already secure.
- Sessions use a signed JWT in an HttpOnly cookie - it can't be read by page scripts, which blunts token theft via cross-site scripting.
- An account is entirely optional. You can browse, plan, share links, and vote without one.
Transport & delivery
- HTTPS everywhere: plain-HTTP and www requests are 301-redirected to the canonical secure origin.
- HSTS (
Strict-Transport-Security, one year) tells browsers to refuse an insecure connection to the site in the first place.
Request integrity
- Every state-changing API call (saving a build, voting, editing a profile, moderation) is checked for a same-origin request before it runs, so another site can't drive actions with your session.
- Serverless endpoints validate and bound their inputs - IDs, revisions, and payload shapes are verified, and account ownership is enforced from the verified identity, not from anything the client claims.
Browser-hardening headers
- Content Security Policy restricts scripts, styles, images, and connections
to this origin plus a short, named allow-list;
frame-src 'none'andobject-src 'none'block embedded frames and plugins. - X-Frame-Options: DENY - the site can't be framed, defeating clickjacking.
- X-Content-Type-Options: nosniff stops MIME-type guessing.
- Referrer-Policy: strict-origin-when-cross-origin keeps full URLs from leaking to other sites.
Anonymous voting privacy
- Guest votes are tracked by an HMAC-SHA256-derived key, never the raw browser token, and the cookie holding it is HttpOnly, SameSite=Lax, and Secure. The server stores only the derived key - it cannot be reversed into your identity.
Data we keep - and don't
- For an account we store your email and a display name you choose. That's it.
- Saved builds and your tier list are private by default; profiles are private until you explicitly opt in to a public one.
- No third-party trackers, no ads, and no analytics currently run on the site.
Architecture
The site is a statically generated set of pages served as flat files, with a small serverless API for the community features. There's no traditional application server to compromise and the attack surface is deliberately minimal - most of the site is just HTML that can't do anything dangerous.
Reporting a vulnerability
Found something? We want to hear it. Email help@lolclassicwiki.com with the details and we'll get back to you. Please don't publicly disclose an issue until we've had a chance to fix it.
See also the legal & privacy page for data-retention, deletion, and the full disclaimer.