Security designed around a small, public product

Controls in the product

Browser responses use a restrictive Content Security Policy and modern security headers. Server endpoints validate content type, size, schema, origin, and request rate; signed Share snapshots cannot be changed without invalidating their signature.

The market gateway validates provider messages, freshness, and sequence integrity. If a trustworthy live frame cannot be established, directional output fails closed instead of replaying fixtures or presenting stale movement as live.

• No user accounts, password database, wallet connection, or trading permissions
• Donation addresses are verified at build time and displayed for copying only
• Analytics excludes wallet addresses, market payloads, and free-form personal data
• Operational secrets are kept outside the repository and redacted from logs
• Frozen dependencies, immutable CI action references, advisories, licenses, and release changes are checked before release

Availability and data boundaries

Application request, body, rate, and live-connection limits reduce routine abuse. Railway hosts the service. Cloudflare manages authoritative DNS, but the captured apex and live gateway are not proxied through Cloudflare, so we do not claim that Cloudflare WAF or bot controls protect those hosts.

Hosting, DNS/TLS providers, and cookieless analytics can process limited technical request data and operational logs. Market Tug minimizes this data and does not claim that absolutely nothing is processed; the Privacy page describes the current boundary.

Responsible disclosure

Report a suspected vulnerability to hello@markettug.com with the affected URL, impact, safe reproduction steps, and a way to contact you. Please do not access other people's data, disrupt the live service, or publish an unresolved issue before we have had a reasonable opportunity to investigate.

We acknowledge actionable reports, assign severity, preserve a minimal incident record, and prioritize containment and recovery. We do not offer a paid bug bounty at this stage and cannot promise compensation.

Review scope and limitations

The baseline is self-assessed against applicable OWASP ASVS 5.0 Level 1 controls, with selected Level 2 controls where they fit this public, account-free service. This is a working engineering baseline, not an OWASP certification.

No independent penetration test or formal security certification is claimed. Security is not absolute; controls, dependencies, hosting configuration, and incident procedures are reviewed as the product changes.