Docs/Trust
Security: codes, sessions and keys
How are the secrets handled, and what should I do on my side?
Checked against the code on
On our side
- Sign-in codes are six random digits from a cryptographic generator, hashed together with the email they were sent to, and dead after ten minutes or five wrong guesses. Five codes per address per hour.
- Sessions are 256-bit random tokens stored as SHA-256 hashes, in a cookie that is HttpOnly, Secure and SameSite=Lax. Thirty days, and Sign out everywhere kills them all.
- API keys are 32 random URL-safe characters after
askr_live_, stored as a hash, shown once. - Money is an append-only ledger. The application role can insert and read; it cannot update or delete a row.
- Payment webhooks are verified with an HMAC signature in constant time before a single credit moves.
- Transport is HTTPS only with HSTS, a strict content security policy, and no third-party scripts on the site.
On your side
- Treat a key like a card number: environment variable, never a repository, never a browser.
- Cap every key a script uses. Daily caps.
- One key per place, so revoking one costs you one place.
- Lost a device: Sign out everywhere in the wallet, then revoke any key that was on it.
- Only ever send crypto to an address shown in your signed-in wallet.
Reporting a vulnerability
Email ask@heyaskr.ai with security in the subject. Say what you found and how to reproduce it; we reply directly and fix first, disclose after.