Security & Transparency

Check it yourself

These are worth running on any site before you trust it, this one included. All free, all run by people with no connection to this site, all take seconds. The server asks the five of them again every twelve hours so there is something to read here without going anywhere, but the number here is the summary and the link is the proof. Anyone can type any result they like onto their own website. This site included.

One of them reads oddly. Google Safe Browsing says "No available data", which sounds like a shrug and is not one. When Google has decided a site is dangerous it says so there, in red, in plain words. Nothing listed is what clean looks like.

What the site can and cannot do in your browser

When people say a website is unsafe they usually mean one of two things. It runs someone else's code, or it quietly sends what you do somewhere else. Both are switched off here in your browser, by a content security policy that goes out with every page. Your browser is the one enforcing it, not the site. You can read the whole thing yourself in developer tools under Network, or on any of the scanners above.

Can it		How that is enforced
Run code from another website	No	Scripts are only allowed from hapless.studio. There are zero third party scripts on the site, so there is nothing to allow.
Send what you do to another server	No	The page can talk to hapless.studio and its own API. Nowhere else. Anything else is stopped before it leaves.
Use your camera, microphone or location	No	All three are switched off for the site at the browser level, so it cannot even ask.
Install or download anything	No	The site is web pages. There is no installer, no extension and no executable anywhere on it.
Run plugins or Flash style content	No	Plugin content is refused outright.
Be embedded inside somebody else's page	No	Only hapless.studio can frame hapless.studio, so the site cannot be wrapped in a fake one.
Send a form somewhere else	No	Forms can only submit back to this site.
Be loaded over plain unencrypted HTTP	No	HTTPS only, and browsers are told to remember that for a year, subdomains included.
Show pictures and video from other sites	Yes	This one is deliberate. Wiki editors embed images and clips in pages, and YouTube embeds are allowed. Those are pictures and video, not code.

What the site collects, and what it never collects

The full detail is in the Privacy Policy. The short version:

If you are only reading

Nothing identifies you. No cookies are set at all, which you can confirm yourself in your browser's storage panel on any page of this site.

The site counts how many times each page has been read. That is one number sat on the page, not attached to anybody. It also counts how many different people came by on a given day, and that one is worth spelling out, because it is the bit most sites go quiet about:

• Your IP address and browser name get mixed with a random secret, made fresh every day, and run through a one way hash.
• Only the hash is kept. There is no way to turn it back into your IP address.
• The day's secret is thrown away when the day ends. After that the hash cannot be made again, even from the same address.
• So you on Monday and you on Tuesday are two numbers with nothing linking them. Nobody can follow anyone across days, and there is no way to tell who read what.
• Those records go after 60 days.

If you log in

Logging in is optional. It exists so editors can be recognised, and it happens on Discord's own site. Discord hands over your user ID, your username, your avatar and which roles you hold in the Town Wiki Discord. That is everything it asks for.

What it never collects

• Your email address, phone number or address
• Payment details of any kind. The site takes no payments at all, so there is nothing to take them with.
• Your Discord password, or any Discord login of any kind. The site never sees it. That happens on Discord.
• Your private messages, your friends list, or the other servers you are in
• Analytics profiles, advertising IDs, or anything that follows you around other websites

Nothing is sold and nothing goes to advertisers. There is no advertising on this site and there never has been.

Who can see what

What you can do comes from your role in the Town Wiki Discord, and the server checks it on every single request. It never takes your browser's word for it. Lose the role in Discord and the access goes with it, even if you are still signed in.

Level	What it can do
Anyone	Read the wiki. No account needed and none is offered for reading.
Editor	Write and change wiki pages, and upload images to them. Every change is recorded with the account that made it.
Manager	The above, plus reviewing changes, moderation tools and the member list.
Owner	Everything, including site settings. That is one person.

Two things worth saying up front. Edits are public and have a name on them, same as every wiki, so if you edit a page people can see it was you. And anything uploaded to the media library can be seen by anyone who can see the page it is used on.

How accounts and pages are protected

• The whole site is served over HTTPS, and browsers are told to refuse anything else for a year.
• Your login session is cryptographically signed, so it cannot be edited or forged into a different account or a higher role.
• The session cookie is marked HttpOnly and Secure. Scripts in your browser cannot read it, and it is never sent unencrypted.
• Staff sessions expire faster than reader sessions.
• A page you are not allowed to open is refused before the file is sent, rather than sent and then hidden. Hiding it in the browser would mean the contents were sat on your machine anyway.
• My API only answers this website. A page on any other domain cannot call it.
• Requests are rate limited, so one person cannot flood the site.
• Uploads are limited to editors, and refused off the request header rather than after the server has already taken the file.

What this site does not run

Worth saying, because these three get mixed up constantly and only one of them is this site.

• This site does not make the games. Town, Town Debug and SIPHON are made and run by Hapless Studios.
• This site does not run the main Hapless Studios Discord.
• It is this website and the Town Wiki Discord. That is it.

So nothing here holds anything about in game bans or about what happens in the main Discord, and none of it could be changed or deleted from this end anyway. That has to go to Hapless Studios.

Getting your data removed

Open a ticket in the wiki Discord and ask. You can ask what the site holds, ask for it to be corrected, or ask for it to be deleted. It gets dealt with within 30 days.

Two limits, and they are the same two every wiki has. The record that an edit happened normally stays, because that is the whole point of page history. And moderation records for the serious stuff are kept, because otherwise someone wipes a ban and walks straight back in. Mention it in your request and you will be told exactly what can go and what cannot.

Found something wrong

Say so. There is a security.txt on the site in the standard format, and the short version is this:

• Open a ticket in the wiki Discord and say it is a security report.
• Say what you found and how to do it again, and leave a fair gap for it to be fixed before you tell everyone.
• Nobody gets chased for reporting something in good faith. Just do not go digging through other people's data, do not break the site for everyone else, and do not point automated scanners at it.

What is not perfect

A page like this is worth nothing if it only lists the good bits, so here are the parts that are not.

• One vendor out of eighty nine calls the domain suspicious. Gridinsoft does. Nobody else does. It is not a malware detection and it is not the number VirusTotal counts, so that headline still reads no vendor flagged this domain as malicious. Suspicious and malicious are two different columns. Raters like that one tag a lot of small new domains on traffic alone. It is written here because you would spot it yourself about thirty seconds after opening the link above, and it is better read here than found.
• The front page needs inline scripts allowed. The content security policy has to permit inline scripts, and that is the one thing the Mozilla scan marks down. Script files from other domains are still refused outright, which is the part that keeps anyone else's code off the site.
• The source is not public. The repository is private, so you cannot read the server code. You can read every file the site sends you though, because the whole front end is plain files and view source shows the lot, and urlscan records the same thing independently.
• Rate limiting for signed out visitors slows people down, it does not stop them. It works off an address the network reports, which is fine for stopping a flood and not good enough to call a real control. Signed in requests get limited by the session instead, and that one cannot be faked.
• Nothing is ever finished. Things get found. When they do they get fixed and the date at the top of this page moves.

How to tell whether any website is safe

None of this is about this site. It is what to do when anyone sends you a link, and it is worth knowing, because the games this wiki is about pull in a lot of people trying to take accounts off players. Use it here as well. Nobody minds being checked.

Read the address before you read the page

Nearly every fake site is a real name with something done to it. Find the first single slash in the address and read the word immediately to its left, because that is the only part that says who you are actually talking to. Everything before it can be made to say anything.

• hapless.studio/wiki is this site. The name ends in hapless.studio.
• hapless.studio.free-robux.net is not this site. That address belongs to free-robux.net, which has just stuck this name on the front of its own.
• hapiess.studio is not this site either. Letters get swapped for ones that look like them, and an l and an I are the same shape in a lot of fonts.

The padlock means encrypted, not honest

It means nobody in the middle can read what you send. It says nothing at all about who is on the other end, and a scam site can get one in about a minute for free. A padlock on a site you do not recognise is not reassurance, it is the bare minimum.

Look at what it is asking you for

This is the one that catches almost everything.

• Nobody real asks for your password to something else. This site will never ask for your Roblox password. Neither will anyone who actually works on the game.
• Watch where a login actually happens. Logging in here sends you to Discord, and once you are there the address must say discord.com before you type anything. A login box that appears in a little window without the address changing is the oldest trick there is.
• A website should never need you to install something. Not to view a page, not to claim anything, not to run a generator. If a link wants an executable, that is the end of the conversation.
• Free currency does not exist. There is no generator. Every one of them is either after your account or after a survey payout.

Notice when you are being hurried

Countdown timers, limited spots, act now, your account will be deleted. Urgency is not a feature of honest websites, it is a technique for stopping you thinking. Anything real will still be there in ten minutes when you have asked someone.

Run it through a checker

The free tools at the top of this page work on any address, not just this one. Two are worth knowing by name:

• urlscan.io is the one to reach for with a link you do not trust. Paste it in and urlscan opens the page in a sandbox so that you do not have to, then lists every file it fetched and every server it spoke to. You find out what a page actually does without it touching your machine.
• VirusTotal takes a domain or a file and gives you about ninety companies' opinions at once.

Both are free, neither wants an account, and both take seconds.

One thing to understand about the results: a clean report is weaker evidence than a dirty one. A brand new scam site has a clean record because nobody has caught it yet. Clean plus an address you recognise plus no request for a password is what safe looks like. Clean on its own is not.

If you got it wrong

It happens, and it happens to people who know better. Change the password on the account you gave away, turn on two step verification, and change it anywhere else you used the same one. Then tell somebody, because the people who lose the most are the ones who sit quiet about it for a week.

Contact

Anything on this page, a security report, or a question about your data, all go through a ticket in the Town Wiki Discord. It reaches the owner directly.

Read the Privacy Policy Read the Terms of Use