How we protect your account

Application security

CSRF tokens on all state-changing forms, output escaping against XSS, parameterized queries against SQL injection, strict security headers and secure session cookies.

Financial integrity

Row-level wallet locking, database transactions for every money movement, immutable double-entry ledger, idempotent approvals and reconciliation tooling.

Secrets handling

Passwords hashed with bcrypt. API secrets, webhook secrets, gateway credentials and bot tokens encrypted at rest (AES-256-GCM) and displayed only once.

Abuse prevention

Rate limiting on login, registration, UTR submission and API requests. Nonce-based API replay protection with timestamp tolerance windows.

Found a security issue? See our security policy for responsible disclosure.