SECURITY
Security at FPS Lounge.
How we protect accounts and payments
- Sign-in runs on Firebase Authentication.
- Sessions use a signed session cookie.
- Role checks run on every server call.
- Stripe handles all card data. We never store card numbers.
- Videos are served through signed URLs.
Responsible disclosure
- Email support@fpslounge.com with "Security" in the subject.
- Include the affected URL, steps to reproduce, and the impact you see.
- We acknowledge reports within three business days.
- Do not access other users' data.
- Do not run denial-of-service tests.
- Give us a reasonable time to fix the issue before you publish.
- We will not pursue good-faith researchers.
Scope
- In scope: fpslounge.com and its subdomains.
- Out of scope: third-party services.