01
Account security
Passwords are stored as one-way hashes, sessions use HttpOnly cookies and authentication events can be audited. Never share passwords or sessions.
02
Financial integrity
Balance movements use double-entry ledger records. Campaign budgets are reserved, withdrawals enter a hold and idempotency controls reduce duplicate processing.
03
TRX safety
The private key stays outside the web app in the isolated payout service. Source, recipient, amount, network and signed bytes are bound before broadcast. Ambiguous chain results never trigger an automatic second transfer.
04
Report a vulnerability
Use the Security category on Support with reproduction steps and impact. Do not access real user data, disrupt service, use social engineering or demand payment through threats.