How Pogl stays secure in the age of AI
A service similar to Pogl recently had a personal data leak. Pogl took this as a reason to strengthen its monitoring and security measures, and every attack attempt over the past month was safely blocked.
- On October 21 we were hit by a DDoS attack that sent 26 million requests to the home page. Now a CDN serves the pages people see when they are not logged in, and requests that arrive at the same moment ask the database only once.
- Since then, AI jailbreak prompts, fake payment receipts, server password guessing and web vulnerability scans have followed. All of them were blocked, and no coins or credits were granted through these attempts.
- Every attempt was safely blocked. Your account, coins and games were not affected, and there is nothing you need to do.
As more people use Pogl, attack attempts keep coming in. After seeing a personal data leak at a service similar to Pogl, we strengthened its monitoring and security measures. On November 13 we went back through our records and checked, one by one, what was attempted and where it was stopped. We looked at creation requests, AI conversations, payment records, server access logs and web request logs together.
In short, every attempt was safely blocked. We found no sign of anyone getting into our servers or database and no sign of secret keys leaving, and your account, coins and games were not affected. There is nothing you need to do. Below is what we found, attempt by attempt.
October 21: a DDoS attack
At 6 p.m. on October 21, a DDoS attack hit the pogl.com home page. 26 million requests arrived at once. Our firewall filtered out most of them, and each of the 2.6 million that got through read from the database.
The home page that logged-out visitors see is nearly the same for everyone, yet we were reading the game list from the database on every request. Because the load on the database grew with the number of requests, we changed this right after the attack. We changed two things.
- A CDN now serves the home and Explore pages to people who are not logged in, sharing the same page for 60 seconds. These requests never reach our servers.
- For requests that do reach our servers, data that is the same for everyone, such as the public game list, is kept for 15 seconds. Requests that arrive at the same moment are merged and ask the database only once.
We recreated the situation in a test environment to confirm it. When we sent 1,000 logged-out home page requests at the same time, the queries the database received dropped from 15,567 before the change to 12 after.
Attempts to make the AI break its rules stopped at the planning stage
Some people pasted “AI jailbreak prompts” that circulate online into the creation box instead of a game description. These are texts that tell an AI to ignore its rules. From October 21 to November 7, five people tried seven times, with prompts in English, Chinese and Korean. Requests to build cheats or aimbots for other games came in along with them.
When Pogl receives a creation request, a planning AI first reads it and writes a plan. All seven attempts stopped at this step as “not a game request.” No game was built, and none was published. Misuse requests dressed up as games, such as a tool to get around school internet filters or a way to pass Pogl coins between accounts, were refused at the same step.
Fake payment receipts were rejected by our servers
Fake receipts made with apps that tamper with in-app payments also came in. One account submitted a receipt with an invalid signature three times within two minutes of signing up, and another submitted eight unverifiable payments in one minute.
Pogl does not grant coins just because the app reports that a payment finished. Our servers check the receipt’s signature and the payment record directly before granting anything. So in both cases, no coins or credits were granted. The accounts that sent fake receipts were flagged automatically, along with other accounts using the same browser.
Server login attempts and vulnerability scans all failed
Since November 1, there have been about 16,000 attempts to log in to two of our servers by trying password after password. Most came from automated programs that roam the internet trying any server they find, and 71 of them used account names containing “Pogl,” such as “pogluser.”
Our servers have password login turned off and accept connections only with keys we registered in advance. So every one of these attempts failed, and every successful login used a key we registered.
There were also requests probing web paths where config files or admin pages are commonly found, such as .env, .git and wp-admin. None of these files or pages exist at public addresses, so every one of them got a “not found” response.
The principles behind Pogl's security
Every attempt this time was stopped because we have followed these principles from the start.
- Important permissions live in server rules. Whatever prompt the AI receives, coin grants, payments and publishing are checked separately by our servers.
- Pages that look the same for everyone never reach the database. No matter how many attack requests arrive, the load on the database barely grows.
- Our servers open only with registered keys. Password login is turned off, and configuration files and admin pages are never on public addresses.
- We keep checking our records. We confirm from the records that attacks were stopped, and respond right away when a new kind of attempt shows up.
- We also check with AI. Through Anthropic's Cyber Verification Program, we use Mythos to continuously monitor the service and review its security.
Wrapping up
- Over the past month we blocked a DDoS attack, AI jailbreak attempts, fake payments, server login attempts and vulnerability scans.
- Your account, coins and games were not affected, and there is nothing you need to do.
- We expect attack attempts to keep coming, and we will keep checking our records, monitor continuously with Anthropic's Mythos, and respond.
