✓
Deployed backend
HTTPS Worker, hardened D1 schema, encrypted secrets, rate limits, and security-event tables.
Security overview
Access decisions belong
on the server.
MADFLIX uses a hardened Cloudflare backend architecture so paid access is not granted merely because a modified client claims a receipt is valid.
Layered protection
01
Backend verification
Production subscription tokens are designed to be checked against Google Play before entitlement is accepted.
02
Encrypted storage
Purchase tokens are encrypted in the backend database; supported local entitlement data uses Android Keystore-backed encryption.
03
Device enforcement
Subscription entitlement data is structured for a controlled installation limit rather than unlimited token reuse.
04
Abuse controls
Request-size limits, rate limiting, hashed security identifiers, and limited event retention help defend public routes.
Production completion
What is live
and what is pending.
The Cloudflare Worker and D1 security foundation are deployed. Google service-account verification, Play App Signing certificate binding, Play Integrity enforcement, and real-time subscription notifications are completed during Play production setup.
→
Play connection
Publisher API credentials and the Play signing identity are attached after the Play app is created.
↯
Revocation updates
Real-time notifications will keep renewals, refunds, expiry, chargebacks, and revocations synchronized.
Responsible disclosure
Found a security issue?
Send a clear report to the MADFLIX support address. Do not include passwords, signing keys, private tokens, or payment-card information.