Safety
- Games run on a separate origin (play.playcard.lol) inside a sandboxed iframe with an opaque origin: no cookies, no storage, no network. A strict content security policy allows only the harness and that game's script hashes.
- The site itself sends a strict CSP, HTTPS only, signed session cookies, an origin check on every POST and rate limits.
- Filters on the source post, on titles and on tickers: slurs (with leetspeak and spacing tricks), adult content, tragedy, self-harm, real people, political, national, ethnic and religious subjects, and copyrighted game, character and brand names.
- Every game has a Report link. Takedowns remove the game from its page, the shelf and the thread, and the play page returns "removed".