Security

Private account and administrative areas require authenticated sessions. Administrative endpoints enforce role authorization, and members may control only the account functions permitted to their identity.

The platform supports its existing password flow and Google OpenID Connect. Google sign-in uses server-side token validation, state and nonce checks. New registrations remain subject to administrator approval.

Production traffic uses HTTPS. Security headers restrict framing, content sources, browser permissions and referrer information. Authentication secrets and service credentials are not intentionally embedded in public frontend code.

Never share passwords, Google credentials, trading credentials or access tokens. If you suspect unauthorized access, stop using the affected session and contact the administrator responsible for your account.