The assessment itself: the risks this service actually carries, scored under the stated method, with the decision taken on each and what remains.
27001 Clause 6.1.127001 Clause 6.1.3 e)27001 Clause 8.227001 Clause 8.342001 Clause 6.1.242001 Clause 6.1.342001 Clause 8.242001 Clause 8.3Review. Reissued by each run of the risk assessment, and immediately whenever a treatment named here is completed or a new risk is identified between runs.
Each entry names the risk, gives likelihood and consequence on the one-to-five scales in the assessment process and their product, states the decision taken under the treatment process, then says what is in place and what is left over. The owner of every risk is the Owner role, stated once here rather than twelve times below.
These are the risks this service has, not a generic list. Several of them are the reason particular rows on the register are still open, and one of them is the only place where the service is genuinely weaker rather than merely undocumented.
R-01 — Loss of the single durable object holding the receipt chain. Likelihood 2, consequence 5, score 10, and treated regardless of the score under the overriding rule for consequence 5. One Durable Object instance holds the control receipt chain, the ninety-day service action log, the player profiles and the spend history, and losing it would destroy the evidence behind most of this register. The realistic path is an operator mistake — a class rename, a migration error — rather than a platform failure. In place, and changed at this version: the chain is hash-linked with its head anchored outside the table it summarises, so truncation is detectable; and state is now copied daily to object storage under a digest covering every key and both tables, with thirty dated copies retained and each run receipting its own outcome, success or failure. The restore path is exercised by a drill that reads the most recent copy back out of object storage, restores it into a scratch instance and compares digests, so the stored copy is proven to reconstitute the state it was taken from rather than assumed sound. Detection has become recovery, which is what the earlier version of this entry said it was not. Residual accepted: at most twenty-four hours of state sits between copies; the restore has been drilled but never executed as a real recovery; and no recovery time objective is committed to. Recorded in DOC-21, and the reason A.8.13 is no longer the register's open engineering gap.
R-02 — Metered spend reaches the hard limit and the game closes. Likelihood 3, consequence 3, score 9, accepted. Traffic is public, unauthenticated and unbounded, and the meters are the only brake. In place: consumption is measured continuously and compared against a five dollar limit held in configuration; when the measurement reaches it the service disables game traffic across every tank by itself, refuses the two unauthenticated write routes that generate the billable Durable Object writes, opens an incident, and writes a receipt recording that spend forced the downtime. Reads stay up — the evidence pages, their JSON and the security report intake — because a gate that also hid the explanation would be a worse control, and none of them is a write. The limit cannot be cleared by turning maintenance off — the reset is refused with a conflict until the limit itself is dealt with. Residual accepted: the game becomes unavailable. That is the intended outcome, because the security policy states the limit will not be raised to keep the service up, and every evidence route stays online while the game is closed.
R-03 — A display name is used to impersonate another player or to break a downstream export. Likelihood 4, consequence 3, score 12, treated. Names are public, unauthenticated, retryable without limit, and echoed into the leaderboard, the tank list, the public log and a fixed-schema text export. In place: one canonical policy is applied on the server to every name crossing the wire. It strips code points that carry no visible glyph but change how surrounding text renders — the C0 and C1 controls, the soft hyphen, the bidirectional overrides and isolates, the zero-width and joiner characters, the Hangul and Mongolian fillers, the line and paragraph separators that would break the text export, the musical and interlinear format controls, and the tag characters that can smuggle hidden ASCII — then trims, clips to sixteen whole code points so an astral character cannot be cut in half, and screens against a word list. Residual accepted: the word list is Latin-only, so profanity written in another script is not screened. That consequence is offence rather than integrity, and widening the net would need a word list per script rather than a broader pattern here.
R-04 — The infrastructure provider suffers an outage. Likelihood 2, consequence 4, score 8, shared and the residual accepted. An outage of the platform's compute, durable storage or object storage takes the game and every evidence route down together, including the incident record that would otherwise describe it. In place: nothing this service can build. There is no second region, no failover and no static mirror, and under a five dollar ceiling none of those is affordable. The risk is carried by the provider under its own certifications, which is what the supplier rows on the register record. Residual accepted on the stated basis that this service is offered with no availability commitment at all.
R-05 — The operator credential is compromised. Likelihood 2, consequence 4, score 8, treated, residual accepted. The operations credential authorises taking the game down, changing billing thresholds, and reading the unredacted operational record. In place: authentication fails closed in every direction — no minted token denies, a non-loopback request that is not over TLS denies, anything that is not a bearer or basic credential denies — and both halves of the basic credential are compared in constant time. The credential lives as a platform secret, never in the tracked configuration, and the production deploy script refuses to run if either secret is absent. Every authenticated control action writes a receipt into the anchored chain, so misuse is evident even though it is not prevented. Residual accepted: it is one long-lived shared credential with rotation on demand and no scheduled rotation, and there is no second factor.
R-06 — A dependency is compromised and reaches the Worker bundle. Likelihood 3, consequence 4, score 12, partially treated, and open. Arbitrary code inside the bundle could falsify every claim this site makes about itself, including this document. In place: the dependency surface is small and pinned by a lockfile, the build is reproducible from a clean checkout, and the Worker imports only the engine, store and protocol entry points of the game module — never its client code, so browser libraries cannot enter the server bundle at all. Left over: nothing scans dependencies for known vulnerabilities, and there is no automated build in which such a scan could run. This is recorded as the weakness it is rather than dressed as a small residual.
R-07 — The register overstates what the service does. Likelihood 3, consequence 5, score 15, treated, and treated regardless under the consequence rule. The register is the service's central claim; a row that cannot be evidenced makes every other row a candidate for the same fault. In place: the honesty rule is written into the source of the register itself, met requires a live route named on the row, implemented-but-unrecorded is recorded as partial, and every evidence link is walked and fetched before a deployment that touches the register — public routes must answer 200, operator routes 401. Residual accepted: that walk is a manual step with no automated gate behind it, so it depends on being performed rather than on being enforced.
R-08 — One person holds every role. Likelihood 5, consequence 3, score 15, treated as far as it can be, residual accepted. There is no separation of duties available and no independent challenge inside the loop. In place: the design substitutes evidence for separation. Control actions write receipts into a hash chain anchored outside its own table, every production change appears in the public change record with an identifier and a classification, and any tank can be reconstructed exactly at any tick from its seed and ordered action stream. Residual accepted, and named for what it is: that is detection, not separation. It is precisely why the internal audit, independent review, competence and awareness rows stay open on the register instead of being written into a document.
R-09 — Public writes flood the action log and evict recorded evidence. Likelihood 3, consequence 3, score 9, treated. The action log is written through an unauthenticated route, and the log is the evidence behind several rows of this register. In place: the public route accepts only two event types; writes are limited per connection and, separately, under a global ceiling across every public caller at once, which is a real global limit because the object holding the counter is a singleton; and publicly written rows are trimmed to their own floor of fifteen hundred rows before the whole-log trim runs, so a flood can only evict other public rows and leaves the rest of the five thousand row capacity for server-recorded evidence. The security report intake accepts one report a minute. Residual accepted: a determined flood still costs metered consumption, which is R-02.
R-10 — Loss of the source. Likelihood 2, consequence 3, score 6, accepted. The source exists as a working copy on the operator's machine and one hosted remote, with the game engine as a pinned submodule. Losing both would not stop the running service, which is deployed and independent of the repository, but it would end the ability to change or rebuild it. Accepted at this score, and noted as the reason the source access row on the register is partial rather than met: access is controlled by the hosting account, not by anything this service can show you.
R-12 — A player cannot have their profile erased. Likelihood 3, consequence 3, score 9, partially treated, and open. There is no route by which a player can ask for their profile to be deleted, and clearing the cookie orphans the profile rather than removing it. The retention rule is also not the clean ninety days the security policy implies: a profile that never scored is deleted after ninety days unseen, but a profile holding a best score is kept indefinitely, because deleting it would silently remove entries from a leaderboard this service publishes as a record. In place: the data held is minimal and pseudonymous, no player identifier appears in any public output, display names are sanitised, and a player can change the only field they can see about themselves at any time. Left over: the erasure route itself, and a decision about what deleting a scoring profile should do to the leaderboard. Recorded in the legal register as a shortfall against an erasure right rather than argued away.
R-11 — The AI system is described in a way that implies more than it is. Likelihood 3, consequence 4, score 12, treated. Specific to the AI system. Calling twenty-four rule-driven sharks an AI system invites a reader to assume a learned model, and a claim of that kind would be the easiest thing on this site to disprove. In place: the AI policy states exactly what the sharks are and what they are not — no model, no training data, no inference call, no third-party service — and the deterministic replay route lets any statement about how a shark behaves be checked against a reconstruction rather than taken on trust. Residual accepted: the wording has to be defended at every future change, which the objectives document makes an explicit target rather than a habit.
Accepted, in plain terms: that the game will close rather than overspend; that a total provider outage would take everything down with no failover; that one long-lived operations credential with no second factor guards the control panel; that profanity in a non-Latin script is not screened; that the register's link check is a manual step; that losing the source would end the ability to rebuild; and that one person cannot audit themselves.
Not accepted, and therefore open: three of them. The absence of any backup or restore for the object that holds the receipt chain — the one entry where the honest answer is that the service is weaker than its own description of itself, and it stays open until an export, a restore path and a recorded restore test exist. The absence of any dependency scanning, which no amount of a small pinned dependency set substitutes for. And the absence of a route by which a player can have their profile erased.
Within ninety days, or immediately on any change that adds a binding, adds a class of route, changes a retention window or touches authentication.
The next run will be comparable with this one line by line, because it will use the same identification sources, the same scales and the same acceptance bands. Where a score moves, the movement is the finding.