Security overview

For publisher diligence · Last updated July 18, 2026

ParkerSyndication is designed so partner sites can embed championship-grade games without hosting puzzle code, without sharing CMS credentials, and without handling card data. This page summarizes controls for technical and security reviewers.

1. Architecture isolation

Games and partner hubs are served from Parker-controlled HTTPS origins (Cloudflare Pages + Workers).
Partners embed via iframe / WordPress plugin / script. Puzzle engines do not run inside your admin origin.
Embeds do not receive your site’s cookies, CMS session, or server-side secrets.
Production ships from a single GitHub source of truth via CI — not ad-hoc laptop deploys.

2. Transport & browser hardening

HTTPS only with HSTS (max-age=31536000; includeSubDomains; preload).
Content-Security-Policy on public pages; games intentionally allow HTTPS partner framing for syndication.
X-Content-Type-Options: nosniff, strict referrer policy, and restricted permissions policy (no camera/mic/geo).
Global edge delivery and DDoS absorption via Cloudflare.

3. Application controls

Partner signup rate-limited by IP.
Tournament / scoring APIs use CSRF tokens and server-side validation where applicable.
Member accounts use salted password hashing (PBKDF2) and HMAC-signed session tokens.
Admin surfaces require separate operator credentials.

4. Payments & memberships

Reader subscriptions use Stripe Checkout / Payment Links. Card numbers never touch Parker application storage.
Ad-free entitlement is issued only after server-side verification of a Stripe Checkout Session (or a verified free-week trial grant).
Visiting a success URL without a paid session does not unlock membership.
Webhook signature verification is supported for subscription lifecycle events when the webhook secret is configured.
Public readiness (no secrets): /api/membership/health

5. Data we process

Partners: site name, URL, payout email, Partner ID, play aggregates, payout method details you provide.
Players: anonymous play telemetry for scoring / Brain Report; optional account email if they register; membership status via Stripe.
Not collected by default: partner CMS credentials, reader passwords for your site, full payment card data.
See the Privacy Policy for rights requests and contact paths.

6. Content & brand safety

Catalog is family-safe / brand-safe by editorial standard (Timothy E. Parker, Guinness World Records Puzzle Master).
Partner Terms require placement only on family-safe sites; we may suspend partners that violate placement rules.

7. Vulnerability reports

Report security issues to [email protected] with subject line Security. Please avoid public disclosure until we have confirmed a fix timeline.