Security

§1 Accounts and passwords #

• Passwords must be at least 12 characters. They are stored only as salted scrypt hashes, a deliberately slow, memory-hard algorithm. Nobody at Frost can see your password.
• Sign-in attempts are rate-limited per network address and per account, and failed checks take the same time whether or not the account exists.
• Changing your password signs out every other session. You can also sign out other sessions from your account page.
• Deleting your account requires your current password, or typing DELETE for Discord-only accounts.
• Frost does not yet offer two-factor authentication or email verification. Use a unique password, and protect the email and Discord accounts linked to Frost.

§2 Sessions and requests #

• Session tokens are random and stored on the server only as hashes, so a copy of the database cannot be used to sign in as you.
• Session cookies are HttpOnly, Secure and SameSite=Lax; see the Cookie Policy.
• Every action that changes your account requires a per-session security token and is checked against the site's own origin, to block cross-site request forgery.
• Pages that show account data are never cached by browsers or proxies.

§3 Discord sign-in #

• Each Discord sign-in uses a one-time, 10-minute state value tied to your browser, so another site cannot finish a sign-in for you.
• Frost asks Discord only for your profile (and email for sign-up), uses the access token once and does not store it.
• A Discord account linked to a license cannot be swapped or unlinked from the website.

§4 Website protections #

• HTTPS only, with HTTP Strict Transport Security. Plain HTTP redirects to HTTPS.
• A strict Content Security Policy: scripts, styles and fonts load only from frostclient.xyz, and the site cannot be framed by other sites.
• No third-party scripts, analytics or advertising code on any page.
• Server errors return generic messages; internal details stay in the server logs.
• Server logs exclude cookies, request bodies, passwords and tokens.

§5 Payments #

• Frost never handles card details or wallet keys. Crypto payments are made on NOWPayments' pages.
• Every payment notification must carry a valid cryptographic signature, and Frost confirms the payment with NOWPayments directly before issuing a license.
• Amounts, currencies and order references must match exactly. Anything unusual goes to manual review instead of issuing a license.

§6 License service #

• Activations are answered with digitally signed tokens that the client verifies, so a fake license server cannot unlock the client.
• The website holds only a narrowly scoped credential that can create licenses linked to a Discord account; it cannot revoke or read other licenses.
• The client sends a one-way hash of hardware identifiers, never the identifiers themselves.
• Activations are rate-limited, and only builds Frost has published are accepted.

§7 Software distribution #

• The client is downloaded only from your signed-in Frost account at frostclient.xyz, over HTTPS. Frost does not distribute builds through any other site.
• Your account shows the SHA-256 checksum of the current build. To check your download, compare it with the output of sha256sum on Linux or Get-FileHash in Windows PowerShell.
• Release builds are produced by an automated build pipeline from Frost's private source repository.
• Frost staff will never send you a client file through direct messages. Treat any such file as malware.

§8 Data and access #

• Administrative functions require a separate secret token and are not reachable from the account interface.
• Secrets are kept out of the source code and supplied to the servers at run time.
• The website runs under its own unprivileged system account. Its database lives outside the published website files and only that account and the server administrator can read it.

§9 What Frost does not claim #

• No SOC 2, ISO 27001 or other certification.
• No independent security audit or penetration test.
• No 24/7 monitoring or uptime guarantee. The status page shows configuration, not live uptime.
• No bug bounty. Frost runs a vulnerability disclosure program without payments.

§10 If something goes wrong #

If a security incident affects your personal data, we will tell you without undue delay where it is likely to put your rights at risk, and notify the relevant authorities where the law requires it. We will say what happened, what data was involved and what you should do.

§11 Report a security problem #

Please do not post security problems in public channels. Follow the Vulnerability Disclosure Policy and open a support ticket in the Frost Discord server, marked as a security report.