Security

BanterBoost makes no claim to be secure, certified or audited. Nobody has reviewed it independently. What follows is what is actually in place.

What is in place

• No passwords. Sign-in is Google only. There is no password stored here, so there is none to leak.
• No card details. Payments go through Stripe and card numbers never reach this product.
• Every league’s data is walled off from every other league’s, enforced beneath the app rather than left to the app to remember. Ask for one league while looking at a different one, and you get nothing back, never somebody else’s answer.
• The assistant cannot go digging through your league’s records on its own. It calls a small set of specific functions, each of which checks what you are allowed to see.
• What lets this product talk to the AI model and to Stripe never reaches your browser; a check fails the build if it ever would.
• Payment notifications from Stripe are verified before anything acts on them.
• Requests are rate limited, and the limiter identifies you by a salted hash rather than by keeping a list of who visited.
• Browsers are told not to frame, sniff or leak the pages.

What is not in place

Written down because a security page that lists only strengths is not a security page.

• No independent audit and no penetration test.
• The strictest browser protection, a content security policy, is running in report-only mode while it is watched, not yet enforcing.
• No automated dependency scanning.
• No audit log of administrative actions.

Reporting a vulnerability

Please report it privately rather than publicly, and give us a reasonable chance to fix it before telling anybody else.

Write to security@fplbanterboost.com.

Please do not test against other people’s accounts or leagues, do not run anything that degrades the service for others, and do not access data that is not yours. There is no bounty; there is a thank you and a fix.

Acceptable use · The assistant