Security & Disclosure

• No backend. CrewPlay has no servers, accounts or cloud storage, so there is no central store of player data to attack.
• Crew Link treats every message as untrusted, in both directions. Seats are tied to the connection they arrived on and can only be reclaimed with a secret token; each connection has a message budget; and every game re-checks a guest’s move with the same rules the shared screen applies. In Rock Paper Scissors no phone is ever sent another player’s hand before both are out, so a modified phone has nothing to read early.
• Purchases unlock only when Google Play reports them as paid, for this app and this product, and, in release builds, when Google’s cryptographic signature checks out.
• No deep links, so other apps cannot open CrewPlay at an arbitrary screen, and nothing is logged from release builds.
• No content comes from the internet: even the Daily Challenge word is picked on the phone, from the app’s own profanity-filtered list.
• This website makes no third-party requests and is served with a strict Content-Security-Policy, HSTS and anti-framing headers.

• Crew Link traffic is not encrypted. It never leaves the local network and carries only game information, but anyone controlling that network could read it. Play on a hotspot or network you trust.
• Rooms are visible on the network. Anyone on the same Wi-Fi with CrewPlay open can see that a room exists and the host’s nickname.
• A rooted or modified phone can read or change any app’s local data, CrewPlay’s included, such as coins. That only affects that phone.

1. Email support@epsilondevelopers.xyz with the subject “Security report”, or use the contact page.
2. Tell us what you found, the steps to reproduce it, the CrewPlay version (Settings → About), your phone model and Android version, and what an attacker could do with it.
3. Please do not include other people’s personal information, and keep the issue private until we have released a fix or 90 days have passed, whichever is sooner.

Our machine-readable contact details are at /.well-known/security.txt. We do not currently run a paid bug bounty, but we will gladly credit you.

If you make a good-faith effort to follow this policy, we consider your research authorised, we will not pursue or support legal action against you for it, and we will help if anybody else does. In return, please:

• test only on devices, accounts, networks and Crew Link rooms that you own or have permission to use;
• never access, change or delete other people’s data, and stop as soon as you reach any;
• not degrade anybody’s experience of CrewPlay, or the website, for other users;
• give us reasonable time to fix an issue before telling anybody else; and
• keep within the law.

With your permission, we will thank you by name in the release notes and on this page.

• Only install CrewPlay from Google Play. Copies from anywhere else may be modified.
• Keep it updated: Settings → About → Check for updates.
• Host Crew Link on your own hotspot rather than public Wi-Fi.
• Turn on purchase authentication in Google Play if other people use your phone.