Security, by default.
Not a settings page you have to find. These controls are on from the first sign-in.
Compulsory verification
No account signs in until its email is verified. Verification links are single-use and expire in 24 hours.
Email OTP, every device
Passwords are followed by a six-digit code sent to your inbox. Trusted devices can skip it for 30 days. Backup codes work offline.
Argon2id hashes
Passwords are hashed with Argon2id at 19 MiB, two passes. We never store or log plaintext passwords.
Rate limits everywhere
Sign-in, signup, OTP, password reset, contact and reports are rate-limited per IP. Repeated failures are banned at the edge.
Session control
Sessions are hashed server-side, expire, can be revoked individually, and are all revoked when you change your password.
Audit trails
Security-sensitive actions are recorded with actor, time and IP. Your credit ledger is append-only and visible to you.
Transport and edge
TLS 1.2+, HSTS, strict security headers, Cloudflare Turnstile when enabled, and fail2ban on every subdomain.
Report a vulnerability
Email security@chessurge.org. We will acknowledge within 48 hours and never prosecute good-faith research.