Security

Account and session protection

• Password hashing rather than plaintext storage
• Verified-email onboarding
• Replay-resistant verification links
• Secure session-cookie configuration
• Role checks on protected routes

Request and data controls

• CSRF validation on state-changing forms
• Server-side input validation
• Parameterized database access
• Database transactions around balance-changing actions
• Protected KYC document delivery

Financial safeguards

• Manual administrator review of funding requests
• Pending withdrawals reserve available balance
• Approved payouts require a transaction hash
• Package purchases store immutable term snapshots
• Reward distribution is restricted to a CLI scheduler

Privileged access

Administrator routes are separated from client routes. Sensitive actions use role protection and can produce audit metadata for later investigation. Access should follow least-privilege principles.

What every user must do

• Use a unique password and protect email access
• Verify network and destination before transferring USDT
• Never disclose seed phrases, private keys, or codes
• Sign out on shared devices
• Report unexplained account activity immediately

How security events should be handled

1. ContainRestrict affected access and preserve evidence.
2. InvestigateReview sessions, financial records, and administrator events.
3. CorrectResolve the weakness and reconcile affected records.
4. CommunicateProvide an accurate impact and status update.