Security

Encryption & transport

• All traffic is served over HTTPS, with HSTS so browsers refuse insecure connections.
• A Content Security Policy and standard hardening headers (nosniff, referrer-policy, permissions-policy, frame protection) are applied across the site.

Accounts & authentication

• Sign-in uses a single-use, time-limited code sent to your verified email address; codes are stored as hashes and are invalidated after use.
• Sign-in and sensitive endpoints are rate-limited to resist brute-force and abuse.
• Each account's data is isolated; ownership is enforced server-side so one user cannot read another's data.
• Admin/operator tools require sign-in and support an additional one-time-code check.

Your broker & trading connection

• AlienAlgo never receives your broker login or password. MT5 automation runs through a licensed Expert Advisor in your own terminal, authenticated by a token you control.
• Trade execution happens at your broker; server-side limits guard automated order sizing.

Payments

• Payments are processed by established third-party processors — AlienAlgo does not store card or wallet details.
• Payment webhooks are signature-verified so they can't be spoofed.

Data handling

• Public content and private/authenticated data are separated; private APIs are not indexable and require a valid session.
• Secrets and tokens are kept server-side and never exposed in the frontend.

Responsible disclosure

If you believe you've found a security issue, email [email protected] with details and steps to reproduce. Please don't publicly disclose it until we've had a reasonable chance to fix it. A machine-readable policy is at /.well-known/security.txt.