Security

On-Device Processing

Mafkers processes all game files locally on your device. No game content ever leaves your computer. This is our core security principle.

Authentication

• PKCE OAuth flow (RFC 7636) for desktop authentication
• Tokens stored in OS keychain (macOS Keychain, Windows DPAPI, Linux Secret Service)
• JWT verification via Clerk JWKS
• Custom URL scheme (mafkers://) with CSRF protection

Code Signing

• Windows: Azure Trusted Signing
• macOS: Apple Developer notarization
• Auto-update: Ed25519 signature verification

Data Encryption

• HTTPS/TLS 1.3 for all network communication
• HSTS enabled with preload
• Translation cache on device (SQLite, optionally encrypted with AES-256-GCM)

Vulnerability Disclosure

We welcome security research. If you find a vulnerability:

• Email: security@mafkers.com
• Allow 90 days for remediation before public disclosure
• Bounty: $50-$500 depending on severity

Compliance

• GDPR (EU)
• UU PDP (Indonesia, UU No. 27/2022)
• CCPA (California)