Protect your access
Passwords use Argon2id. Sessions use HttpOnly cookies. Hashed backup codes, session revocation, and scoped API keys help protect account access. Staff permissions are checked on every administrative action.
SECURITY
Security is part of the product.
Controls should be explainable, testable, and present on the server.
Every record has an owner
Account actions authorize the authenticated user on the server. API keys cannot read or trade another user’s account. Support, editorial, finance, and administrator capabilities have separate permissions.
Financial changes leave a trail
Wallet postings are balanced and append-only. Purchases and mutations use request keys and compare-and-swap revisions. Payout reviews and sent-status changes are audited.
Report a security issue
Report suspected account access, payment or authorization issues through support. Include the affected page and time, and avoid sending passwords, recovery codes or API keys.