Security Update: New Guardrails Against Bad Actors

The Card Exchange works on trust: install the plugin, and your collection appears on the highscores — no account, no setup, no gatekeeping. Recently a small number of accounts have tried to take advantage of that openness by sending forged, abusive traffic to our services. So we're adding guardrails. If you're an honest player — and that's nearly everyone — nothing changes for you.

What we found

Our ingest service — the endpoint the highscores plugin uploads collections to — has been receiving payloads that no real player could produce: enormous fabricated collections, sent repeatedly, under invented names. This is not clever play or a big collection; it's an attempt to disrupt the boards and waste the platform's resources, and it's exactly the kind of thing that makes open, no-setup services harder to keep open.

The guardrails

• Uploads now have to be plausible. A collection claim is checked against what the character behind it could actually have earned — building a card collection takes playing time, and playing time leaves a trail. A payload wildly out of proportion to its character is rejected outright and nothing is stored.
• Repeat offenders are cut off. A sender who keeps pushing forged payloads after being refused stops getting polite explanations and starts getting refused entirely, before their traffic touches anything.
• Abuse leaves a record. Where we identify malicious practice or an attempt to abuse our services, we retain the right to collect and retain the IP addresses involved, and to use them to restrict or block access to the platform. This is done only where we believe there may be a security concern within our platform — it is a security measure, not surveillance.

What this means for honest players

Nothing, in practice. Anonymous uploads are still welcome — installing the plugin remains enough to appear on the boards. Your collection, however large, is a real collection attached to a real character, which is precisely what the guardrails check for. In the unlikely event an upload of yours is ever refused, the plugin will tell you why in chat rather than failing silently, and the contact page reaches a human who can look into it.

Our position on abuse

We want the Card Exchange to stay what it is: an open, free, community platform. That only works if abusing it has consequences. So, plainly: if you are found abusing our services, we retain the right to collect the IP addresses involved, to restrict or block your access, and to remove fabricated entries from the boards. The full detail of what we collect and why lives in our Privacy Policy, and what counts as acceptable use is set out in our Terms of Service — both were updated alongside this change.

If you spot something that looks off — a board entry that can't be real, or behaviour that looks automated — we'd genuinely like to hear about it. Reports from the community are how most of these things get caught.