Security

How the studio protects your account and your blueprints, and how to tell us about a problem. Last updated 13 October 2026.

Reporting a vulnerability

Write to contact@elyonmods.com with what you found, the steps to reproduce it and its impact. The contact is also published in security.txt.

• We aim to confirm your report within 7 days and to keep you updated until it is fixed.
• Please give us a reasonable time to fix it before telling others. With your permission we will credit you once it is fixed.
• We will not take legal action against good-faith research that follows this policy. This is a free hobby project, so there is no paid bug bounty.

In scope: this website and its API. Please do not: access or change other people's data (use test accounts and blueprints of your own), run automated scanners, load or denial-of-service tests, use social engineering or phishing, or test Steam, Discord, Vercel or our other providers, which have their own programmes.

How we protect accounts

• We never handle passwords. You sign in through Steam, Discord or a one-time email link. Steam sign-ins are confirmed with Steam itself; Discord sign-ins use OAuth with PKCE and issuer checks, and ask only for your name and avatar.
• Sessions are signed, encrypted, HTTP-only cookies that page scripts cannot read, sent only over HTTPS and only to this site. Every request is checked against the database, so suspensions, role changes and "Sign out everywhere" apply at once.
• Connecting a second sign-in method requires a valid session, and a method already connected to another account is refused. The last method can never be disconnected, so you cannot lock yourself out.
• Handles cannot be reused to impersonate someone: a former handle stays reserved for its owner and redirects to them, reserved names are refused, and invisible or right-to-left control characters are removed from names, handles and tags.
• Sign-ins, saves, uploads, comments, likes, reports, tags and downloads are rate limited per account and network address.

How we handle uploaded blueprints

• Uploads are blueprint exports only: text, at most 2 MB, parsed as data and never run as code.
• Before anything else, each upload is checked for its shape: nesting depth, number of pieces, rooms and values, text lengths, coordinate ranges and whole numbers where the mod expects them. Anything outside the limits is refused.
• It is then opened by the mod's own rules, on the server, in a locked-down engine with no file, network or system access and a strict time budget, and checked against the exact content packs it pins. Unknown pieces or packs are refused.
• We store the mod's own re-export, never your original file. Downloads are served as plain text attachments, and thumbnails are drawn by our server, so a file cannot carry scripts or other content to other players.

How we protect the site

• A strict Content Security Policy: pages run only this site's own scripts with a fresh nonce on every page load, noeval, no plugins, and the site cannot be framed by other sites.
• Every change (saving, liking, commenting) must come from this site's own pages, as JSON, so other websites cannot make your browser act for you.
• Everything players write is shown as plain text. Private blueprints answer "not found" to everyone except their owner, co-editors and moderators.
• Staff permissions are split: moderators can hide content and suspend players; only administrators can delete content and accounts or change roles, and staff cannot act on accounts of equal rank. Every staff action is written to an audit log.
• HTTPS only, with HSTS. Dependencies are pinned, checked for known vulnerabilities on every change, and new releases are adopted only after a waiting period.

What you can do

• Check the address: the studio lives at this site. We will never ask for your Steam or Discord password, or for your sign-in links or cookies.
• Keep your Steam and Discord accounts protected with two-factor authentication (Steam Guard, Discord 2FA).
• If something looks wrong, use "Sign out everywhere" on your page and tell us.

Your data

You can download everything we store about you, end all your sessions, or delete your account from your page. See the privacy notice for what is stored, why, and for how long.