← Dashboard About Privacy Terms Contact Metrics Methodology Status API docs Pricing Roadmap Security

Security

How accounts and browsers are protected, what we never ask for, and how to report a problem.

We never ask for a seed phrase or a private key: not by email, not in a direct message, not in a form. The scanner and every analytics tab read public chain data and never need a wallet connected. Anyone asking for a seed phrase in DeepGyre's name is not DeepGyre.

Your account

Passwords are stored only as scrypt hashes, never in a form that can be reversed.
Two-factor sign-in with an authenticator app can be switched on in your account.
One press in your account signs out every session you have open.
The session lives in an httpOnly cookie that page scripts cannot read, SameSite=Lax and Secure over HTTPS. Every state-changing request to /api/v1/admin/*, /api/v1/auth/mfa/*, /api/v1/auth/logout-all, /api/v1/keys and /api/v1/billing/* carries a double-submit CSRF token (the bs_csrf cookie echoed back via the X-CSRF-Token header). The audit on 2026-10-11 extended the same gate to /api/v1/auth/change-password, /api/v1/auth/change-email and /api/v1/auth/logout — before that, those two account-takeover targets returned a 400 "password is incorrect" instead of a 403 when the token was missing: the password was checked before the token.
Sign-in attempts and API calls are rate-limited.
Developer API keys are shown once and stored only as a hash; a revoked key stops working at once.

In your browser

Every page is sent with these headers; your browser's developer tools show them on any response.

`Strict-Transport-Security`	HTTPS only, for two years, subdomains included, with the preload directive that asks browsers to build this rule in before a first visit.
`Content-Security-Policy`	Scripts, styles and fonts load from this site only (plus the sign-in challenge while it is switched on), and no other site may frame these pages.
`X-Frame-Options`	DENY: a second guard against clickjacking.
`X-Content-Type-Options`	nosniff: a file runs only as the type it declares.
`Referrer-Policy`	Other sites learn our domain, never the page you were on.
`Permissions-Policy`	Location, microphone, camera and payment APIs are switched off.
`Cross-Origin-Opener-Policy`	Another site's window cannot reach into this one.

No advertising or analytics trackers load on any page, fonts are served from this site, and coin and entity logos are fetched through this site, so your browser does not contact third-party image hosts.

Payments and keys

The key that derives deposit addresses never lives in the web application. It sits in a separate service with no public port, reachable only from the application over mutual TLS, and its seed is encrypted at rest.

What has not been done yet, stated plainly:

the signing service still shares a host with the application;
its key-encryption key is not held in a hardware security module;
no external security review or penetration test has taken place.

Reporting a vulnerability

Write through the contact page; security reports are read first. Describe the issue and how to reproduce it, report privately, and allow a reasonable window for a fix before publishing. The machine-readable policy is at /.well-known/security.txt. There is no paid bug-bounty programme yet.