A security review in June

After a spring of big changes — a new world model, a new way for time to pass, most of the game rewritten — we did something less exciting and more important. In early June 2026 we stopped adding features and reviewed the security of ManageFC from top to bottom.

We will not publish the details of what we found. Describing weaknesses, even fixed ones, helps the wrong people more than the right ones. What we can share is how we approached it and what it means for anyone trusting us with an account.

How we approached it

We looked at the service from three positions: as a visitor with no account, as a logged-in manager trying to reach things that should belong to someone else, and from the inside, checking how each part of the service is set up and protected. Every finding was written down with a severity and a fix, and every serious one was resolved before we went back to building features.

What it changed

In plain terms, the service now gives away less information about itself, exposes fewer moving parts to the internet, and is stricter about who and what can access sensitive data. The way the game handles what you type into it was reviewed so that it can never be misused, and the parts of the service only our team uses sit behind the same single, strict check.

Habits we kept

A one-off review fades quickly if the way you work does not change. Three habits came out of June and stayed:

• Secrets stay out of the code, always.
• Access is reviewed whenever the people working on the project change.
• Every update is followed by a real test of sign-up and sign-in, in a normal browser, because a security setting can quietly break a login form. We learned that one the hard way in August, as told in the registration post-mortem.

What you can do

Most account problems in online games still come from reused passwords. Choose a password you do not use anywhere else, and switch on two-factor authentication in your settings — it is required for the wallet and item screens anyway. If you ever notice something on your account you do not recognise, write to support@managefc.com.

Next in the diary: a quieter month under the hood.