Skip to content
stakeacountry.com
Sign up
Trust

Security

Claims worth making are claims that can be checked. Everything below describes what the running system does, not an aspiration.

These documents are not finished

The registered name, registration number, address and phone are still blank infeatures/legal/merchant.ts. A payment provider will refuse an application whose site does not identify the seller, and a lawyer should review the wording before this is published.

Card details never reach us

Payments are handled entirely by a licensed payment provider. Your card number, expiry and security code are entered on their infrastructure and are never sent to, processed by or stored on our servers. We receive only the outcome of a payment and a reference to it.

This is the single most important fact on this page: the part of a transaction that is worth stealing never passes through us, so it cannot be taken from us.

Passwords

  • Stored with Argon2id, a memory-hard function chosen because it denies an attacker with specialised hardware the advantage they get against older schemes.
  • Signing in takes the same measured time whether the address exists or not, so the form cannot be used to discover who has an account.
  • An account created through Google has no password at all. Password sign-in for it is not merely unlikely, it is impossible.
  • Changing or resetting a password signs out every other session.

Sessions

A session is an opaque random token in a cookie that JavaScript cannot read, restricted to this site and sent only over HTTPS. The database stores only its SHA-256 digest, so a stolen copy of the database does not hand anybody a working session. Sessions can be revoked, and a password change revokes them.

Money

  • Every amount is held as a whole number of cents. No balance is ever a floating-point number, because rounding error in a ledger is missing money.
  • Every movement is recorded as double-entry bookkeeping, and the database itself rejects any transaction whose entries do not sum to zero. It is a constraint, not a convention, so no process, including a mistaken one of ours, can write unbalanced books.
  • Payment records are append-only: they cannot be edited or deleted, only corrected by a further entry.
  • Two people staking the same country at the same instant produce exactly one leader and exactly one charge each. This is enforced by the database and covered by an automated test that runs the race deliberately.
  • Every payment carries an idempotency key, so a retry after a dropped connection cannot charge you twice.

The site itself

  • Served over HTTPS, with the browser instructed never to fall back to plain HTTP.
  • A Content Security Policy restricts what may run on the page, and the site declines to be embedded in a frame on another domain, the usual route to a convincing fake.
  • Requests that change something are rejected unless they come from this site, so a link on another page cannot act as you.
  • Links published by other advertisers are restricted to ordinary web addresses. Attempts to publish a link that would run code are refused when they are submitted, not merely hidden when they are shown.
  • Sign-in, registration and payment endpoints are rate limited against automated abuse.

What a visitor record holds, and what it refuses to

A visitor is a random identifier, two timestamps, a city name and a two-letter country code. There is no device fingerprint, no user agent and no link to an account, and your IP address is not stored or logged on that record. The city is read from a header our hosting platform adds to the request; we run no geolocation service and look nothing up ourselves, so the address stays with the platform and only the city name arrives here.

  • The header is only believed when a proxy we control sits in front and overwrites it. Reached directly, the same header is caller-supplied: anyone could put any city on the globe by sending one. Where that guarantee is absent the value is discarded unread and the line simply does not appear.
  • The city is overwritten on every visit and stored in one column. There is no location history, no second table and nothing timestamped per city, so a record of where somebody has travelled cannot be assembled from what exists, not by us, and not by anyone who took a copy of the database.
  • The globe shows one visitor’s city at a time and never a list. A count says how many people are here and a single city says the board reaches somewhere real; a list of cities beside that count would describe an audience, which is a different thing to publish and is not published.
  • It is never shown to the person it describes, so the line always means somebody else.

The privacy page lists everything we do hold.

Reporting a problem

If you find a security flaw, write to support@stakeacountry.com with enough detail to reproduce it. We will not pursue anyone who reports a genuine issue in good faith and does not access other people’s data or degrade the service while investigating.