Security and Incident Policy
What actually protects your account, and what we will do on a bad day.
Draft. Not yet in force. Nation Economics is not on sale, so there is no agreement between us to govern. These documents are published early so they can be read, questioned and reviewed before the first sale.
They have not been checked by a lawyer. Written by the developer from the product's own design decisions, which makes them accurate about what the software does and unproven as legal instruments.
What protects an account
- No passwords exist. Sign-in is Google or Discord, so there is no password database here to steal.
- Session tokens are stored only as hashes. Reading our session store gives an attacker a list of digests and no way to present one.
- Revocation is immediate. Signing out everywhere invalidates every outstanding session in a single write, rather than waiting for records to expire.
- Linking a Minecraft account requires proof from inside the game, with a code that is shown only to that one player and expires in five minutes.
- Server-to-server traffic is signed, with timestamps and one-time values so a captured request cannot be replayed.
- Audit logging records who did what, with IP addresses hashed rather than stored.
What we are honest about
Rate limiting uses an eventually-consistent store, so a fast burst from many places can briefly exceed a limit before the count catches up. It is a speed bump against abuse, not an exact quota, and we know which parts would need stronger machinery if abuse ever showed up.
This service is run by one person. There is no security team and no 24-hour rota, and saying otherwise would be the kind of claim this policy exists to avoid.
Reporting a vulnerability
Report it through support and we will confirm we have read it. We will not threaten anyone who reports a genuine issue in good faith. Please give us a reasonable window to fix it before publishing.
If there is a breach
- Stop it, and preserve enough to understand it.
- Tell affected customers without undue delay, including what we do not yet know.
- Publish what happened, what was reached, and what changed as a result.
The commitment worth holding us to is the second half of point two. Early notices are always incomplete, and waiting for a tidy story is how customers find out too late.