# Security model

The design assumes a hostile client — reading the network, editing code, replaying requests — and stays correct anyway.

## Hidden information stays on the server

A concealed value is released only for a position the server's replay has proved that player reached, never because the client asked. A rewritten client plays under the same uncertainty an honest one does.

## The server replays the match

The deal is fixed before either player sees a card, and every move is replayed server-side against it — that replay's score is the score; the client's own scoring has no authority. A hash chain seals the move sequence for integrity and sync only.

After both players finish, the deal is released so a player can re-derive and re-score it themselves. We do *not* publish a commitment to the deal *before* play — “fixed before either player saw a card” is stated, not verifiable.

## We are not certified

No independent testing-lab certification and no authority approval, for any game — that requirement is yours to satisfy. Raise it early and we will say plainly what we can document.

## Both players get the same deal

A match is one deal played by two people — except in Spades, where each also sees their bot partner's hand while the opponents' stay concealed. Neither can be dealt a better game, and a loser can watch the winner's replay of the same cards. That is narrower than “luck plays no part”: once players diverge, one can take on variance the other avoided.

## What a finished match is reused for

One thing crosses the boundary between accounts: a finished match's deal and score can be served, read-only, as a practice opponent — ours or another partner's. That pool is shared across operators, with nothing at stake in it.

- **Nothing is written back** — no rating, counter, or record against your player. Practice is not a match.
- **The name shown is the one on the match** — your `displayName` from mint. Omit it at first mint to keep a player's name off another platform's board; a nameless account gets our own handle. See [Identifying your player](/docs/players.md).
- **The deal was already released** to those who played it — never reused for a new match.

## What this means for you

- You do not have to trust our client, because we do not either.
- No fraud tooling needed for the game layer: a dispute is a question we can answer from the replay record — ask your platform contact. No partner-facing route returns a replay.
- Session tokens are short-lived and scoped to one game, so a leak cannot reach another game or player.