Heroes' Conquest: A Strategic Chess Battle is committed to maintaining the highest security standards to protect user data, game integrity, and system reliability. This document outlines the security practices, guidelines, and policies that contributors and users must adhere to ensure a secure gaming environment.

• Protect User Data: Safeguard personal information and game-related data from unauthorized access or breaches.
• Ensure Game Integrity: Maintain the fairness of the game by preventing cheating, unauthorized modifications, or exploits.
• Maintain System Security: Protect the game’s infrastructure from vulnerabilities, attacks, and other security threats.

• User Data Storage: Any user data collected (e.g., move history) should be stored securely using encryption where appropriate.
• Personal Information: Avoid collecting unnecessary personal information. Any required personal data must be handled per privacy laws and encrypted in transit and at rest.
• Access Control: Implement strict access controls to ensure that only authorized personnel can access sensitive data.

• Move Validation: Ensure that all moves are validated on the server side to prevent cheating or exploitation through client-side manipulation.
• Randomization of AI Moves: The AI’s decision-making logic should be secured to prevent predictability or manipulation by external entities.
• Audit and Logging: Keep detailed logs of all game activities, including moves made, to audit and investigate any suspicious activity.

• Secure Communication: All communications between the client and the server must be encrypted using HTTPS to prevent man-in-the-middle attacks.
• Dependency Management: Regularly update all dependencies to the latest versions, particularly security-related patches for libraries like websockets.
• Code Review: All code contributions must undergo peer review to identify and mitigate potential security vulnerabilities before being merged.
• Authentication: Use secure authentication mechanisms for accessing the game's WebSocket server and administrative controls.

• Reporting: Encourage the reporting of security vulnerabilities by the community. Issues should be reported via email to omkargupta702@gmail.com.
• Response Time: Aim to acknowledge reported vulnerabilities within 48 hours and to patch critical vulnerabilities within 7 days.
• Security Updates: Regularly release security updates and notify users and contributors of any important changes or patches.

• Secure Coding: Follow secure coding practices, such as input validation, avoiding hard-coded credentials, and using parameterized queries to prevent SQL injection.
• Environment Separation: Use separate environments for development, testing, and production to prevent unauthorized access or accidental exposure of sensitive data.
• Backup and Recovery: Implement regular backups of critical game data and ensure that there is a tested recovery plan in place to handle potential data loss or system failure.

In the event of a security breach or incident:

• Immediate Containment: Steps should be taken to immediately contain the breach, including isolating affected systems and accounts.
• Notification: Affected users and stakeholders will be notified within 72 hours of the breach being confirmed.
• Investigation and Mitigation: A thorough investigation will be conducted to identify the cause of the breach, followed by the implementation of measures to prevent future occurrences.

Contributions to Heroes' Conquest are welcome. However, all contributors must adhere to the security guidelines outlined in this policy. Any code submitted must be free of known vulnerabilities and should enhance the security of the game.

For security concerns, issues, or suggestions, please contact:

• Email: omkargupta702@gmail.com

Thank you for helping us keep Heroes' Conquest a secure and enjoyable experience for everyone!

Last Updated: August 26, 2024