From f6deb814313a5d139e6c9def637407c0358e3b43 Mon Sep 17 00:00:00 2001 From: salmonik Date: Sun, 8 Nov 2026 12:30:09 +0100 Subject: docs: record the crawler and game-port behaviour --- docs/WEB-PLAN.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'docs') diff --git a/docs/WEB-PLAN.md b/docs/WEB-PLAN.md index 80e797b..d0f9d9d 100644 --- a/docs/WEB-PLAN.md +++ b/docs/WEB-PLAN.md @@ -102,11 +102,14 @@ Test against a staging site with logs both fingerprints and refuses credentials. - The browser has no certificate UI and no credential storage. XSS cannot read the HttpOnly cookie; the backend still must escape every notice. +- `web/robots.txt` disallows every crawler and the site sends `noindex` + headers. The game port is not HTTP: v5 drops a request whose first four bytes + are not a valid frame before `HELLO`, without replying or logging. - The browser speaks JSON, not the game wire. A malicious page cannot use the gateway as a protocol proxy: `Origin` is checked and the session cookie is SameSite=Strict. - The web app is play-money only. No deposits, withdrawals, KYC or real-money - claims belong in v1 copy. + claims belong in v1 copy. Do not advertise it in the player-facing copy. ## Failure behaviour -- cgit v1.2.3