AthletiSync is built by a small team that treats every family record as someone’s kid. Here is what that means in practice.
Families, players, bookings, payments and waivers live in your WordPress database. athletisync.com stores only your organization and billing record.
Every entitlement response is HMAC-signed with a per-site secret so a DNS hijack cannot fool a site into thinking it is licensed, or unlicensed.
Keys and tokens are stored encrypted (libsodium) and never logged. Card and bank details never touch your site; they stay with Stripe or Square.
Security updates are served to every install, licensed or not, and flagged so you know to apply them.
Every unauthenticated endpoint is rate-limited; every record-taking route checks that you own the record.
Parents and owners sign in by email code. No passwords to leak, reuse or reset.
Email [email protected] with steps to reproduce. We acknowledge within two business days, keep you updated, and credit you if you want. Please give us a reasonable window before public disclosure and do not access data that is not yours.
Our disclosure policy is also published machine-readably at /.well-known/security.txt (to be deployed with the production site).
