Security

Authentication & sessions

• Passwords hashed with modern one-way algorithms (never stored in plaintext)
• Server-side session handling with secure cookies where applicable
• Session expiry and logout-all-devices controls in Account
• Administrative functions require server-side authorization (not client flags alone)
• User 2FA: roadmap (TOTP) — enablement tracked for Premium / Operator
• Admin 2FA: required for Operator console before production privilege expansion
• Login anomaly alerts: failed-attempt logging and rate limits; email alerts roadmap

Application controls

• Request rate limiting on auth and heavy market endpoints
• Content Security Policy and security headers on HTML responses where configured
• No collection of exchange API keys, wallet seeds or trading credentials
• Dependency vulnerability scanning in release hygiene (npm audit / CI checks)
• Audit-log retention for security-relevant events (target ≥ 90 days; backups longer if legally required)
• Database access limited to application credentials; no public DB ports

Data protection

• Encryption in transit: TLS on production (tesbot369.com)
• Encryption at rest: host/volume encryption on production database storage
• Secret rotation: environment secrets rotated on staff change and suspected leak
• Backups: regular database snapshots; restore drills on a documented schedule
• Disaster recovery: RTO/RPO targets documented for Operator; educational service may pause during recovery

Responsible disclosure

Email security@tesbot369.com with a clear description and non-destructive proof-of-concept. Do not access other users’ data or disrupt service.

• Acknowledgement SLA: within 3 business days
• Critical issues: prioritised remediation target within 7–14 days after confirmed report
• Public machine-readable policy: /.well-known/security.txt