Information Security Policy

Last updated: October 31, 2026.

What this policy covers

GPN — Game Patch Notes is a public news aggregate. It has no public accounts, no logins for readers, no profiles, no messaging, no store, no checkout and no payments. The only login on the site is the owner-only Site Manager. This policy explains how that small surface is protected, and what is deliberately not collected.

Transport and hosting

HTTPS only in production: the live site is served over HTTPS through Cloudflare (proxy on, SSL Full / Strict) to its Render host. Do not submit anything sensitive over an insecure connection.
No public login surface: there is no reader sign-in to attack, no password reset flow for readers, and no public upload, comment or messaging form in version 1.
Manager only: the Site Manager is the single authenticated surface. It is not linked from the public footer as a login, and it is excluded from search indexing (robots.txt disallows /manager.html, /api/ and /data/).

Manager authentication

The manager password is set only as an environment variable on the host (MANAGER_PASSWORD). It is never stored in a file, never committed to the repo, and never shared in chat or email.
At server start the password is hashed with scrypt (random salt) in memory only; the plain password is not written to disk.
A successful login sets a random session token in an HttpOnly, SameSite=Lax cookie (gpn_session, 24-hour lifetime). There is no “remember me” and no public session.
If the manager password is not set, manager login is disabled (the server returns 503) while the public site keeps working. If a manager password is ever suspected to be exposed, change it in the host environment and redeploy — that invalidates the old password immediately.

Data minimisation

No payment data, no account data, no private messages — GPN does not collect them, so there is nothing of that kind to leak.
Analytics are aggregate only: page-view totals by page, day, device type, browser, operating system, language, country (from Cloudflare's country header when live, otherwise unknown) and referrer. No IP addresses are stored, no visitor cookies are used, no per-visitor records are kept, and age or gender are not collected or inferred. See Privacy Policy and Cookies.
Content data: stories in the manager are headlines, short original summaries, source names and links to original publishers. No full articles are republished, and no private personal data or internal employee material is published as a “leak”.

Third parties

Every story links out to its original publisher; those sites have their own security practices, and GPN is not responsible for them.
Videos are embedded only from the publisher's official embed, where embedding is allowed. No re-uploaded clips are used.
Ad and affiliate partners, when live, are labelled and disclosed (see Advertising and Affiliate Disclosure). No live ad code runs before a consent notice is in place.

Reporting a security issue

If you find a security problem on GPN, report it via the Support page with the page URL, what you saw, and steps to reproduce. Do not publish an exploit, do not try to access the manager or other people's data, and do not test against the site in a way that harms readers. GPN will fix a confirmed issue and, where readers were affected, say so visibly rather than silently.

Changes

This policy will be updated when GPN's surface changes — for example if comments, accounts or a newsletter are ever added. The “Last updated” date above will change with it.

Terms of Use · Privacy Policy · Information Security Policy · Cookies · Advertising · Affiliate Disclosure · Support · Site Map · RSS

GPN — Game Patch Notes. Gaming and tech news, curated, with links to the original publishers.