Legal
Security
Last updated: September 2026
Our approach
Security is a first-class concern at StatBase Sports. We implement defence in depth at every layer — from the database to the network edge.
What we do
- Row Level Security (RLS) enforced at the database layer — no query can return data a user is not authorised to see.
- Service-role keys are never exposed to browsers or mobile clients.
- API rate limiting on all public endpoints to prevent abuse and denial-of-service.
- Input validation using Zod schemas on all parameters before any database query runs.
- Security headers including HSTS, CSP, X-Frame-Options and Permissions-Policy on all responses.
- Secrets management — credentials are never committed to version control.
Responsible disclosure
If you discover a security vulnerability in StatBase Sports, please report it responsibly before public disclosure.
Email: security@statbasesports.com
We will acknowledge reports within 3 business days and aim to resolve confirmed vulnerabilities within 30 days. We do not currently operate a paid bug bounty programme but recognise responsible disclosures publicly (if desired).
Scope
In scope for responsible disclosure:
- Authentication and authorisation bypasses
- Data exposure (private data visible without authorisation)
- Injection vulnerabilities
- Server-side logic flaws
Out of scope: social engineering, denial-of-service attacks against production infrastructure, and issues with no security impact.