Infrastructure
- All traffic is encrypted with TLS; the panel and the staff console run on separate addresses.
- Two-step verification is mandatory for team accounts; passwords are stored one-way (scrypt).
- Seal statuses are signed with Ed25519; our public keys are published at /.well-known/oyunkontrol-keys.json.
- The server that takes payments holds no wallet key; payments are only read from the on-chain record.
Our scanner
OyunKontrolBot reads only public pages of sites that applied, never logs in or submits forms, and identifies itself with its user agent. See the bot page for details.
Reporting a vulnerability
If you believe you have found a security issue in Oyun Kontrol, e-mail [email protected] with the subject “Security”. We keep reports confidential and answer as quickly as possible. Please do not access other users’ data or run tests that disrupt the service.