Trust

Security

Updated 2 November 2026

Joinable sits inside other people's games and takes payments, so we keep the parts that matter small and checked.

Payments

• We never handle card data. Checkout and billing are Stripe's own hosted pages; card numbers go straight to Stripe.
• Payment events are signed. Plans and credit change only on Stripe events whose signature we check.

Accounts

• No passwords to leak. You sign in with a one-time code sent to your email.
• Codes are hashed and short-lived. They expire after 10 minutes, and after five wrong guesses no new code is sent until the last one expires.
• Sessions are hashed too, and signing out ends them on the server.
• The same answer for every email, so nobody can use sign-in to find out who has an account.

Games and keys

• Project keys are public by design, like Stripe's publishable keys: they sit in your game's page.
• Each key only works on the sites you list. Localhost and preview sites you add are free for testing; anything else is refused.
• Players can't take each other's seats. Each player rejoins with a secret id that the others never see.
• Rooms have hard limits on players, message rates and sizes, so one room can't swamp another.

The sites

• Everything is served over HTTPS, with security headers on every response.
• The relay and this site run on Cloudflare's global network, behind its DDoS protection.

Audits

The last full audit was on 2 November 2026: the code, the live hosts, the git history and every published package. Nothing had leaked and no key needed rotating, and its high-severity findings were fixed the same day. We'll audit again as Joinable grows.

Reporting a problem

Found a security issue? Email hello@getjoinable.com with "Security" in the subject. Please give us a chance to fix it before telling anyone else. We'll reply within two working days.