01In short
Halcira can place real orders on your accounts, so it's built to give an attacker as little as possible: your keys never reach us, the website only runs our own code, and it can only be reached through Cloudflare.
Found a security problem? Email [security@yourdomain.com]. Please don't share it publicly until we've fixed it. Details are in Report a vulnerability below.
02Your venue keys
- They stay on your device. [Confirm: keys are encrypted at rest on the machine running the engine and never sent to Halcira servers.]
- Trading permission only. Create keys that can read balances and place orders, never withdraw. If a key leaks, it can't move money off the venue.
- Lock keys to your IP address when the venue offers it.
- Rotate them every few months, and right away if a device is lost or you see an order you don't recognise.
03How the site is protected
| Protection | What it stops |
|---|---|
| HTTPS only, with HSTS | Your browser refuses plain, unencrypted connections to Halcira for two years, so nobody on your network can read or change pages. |
| Strict Content Security Policy | Pages run only scripts from Halcira itself. Injected or third-party scripts are blocked, which shuts the door on most cross-site scripting. |
| No framing | Other sites can't load Halcira in a hidden frame to trick you into clicking Execute (clickjacking). |
| Cloudflare-only access | The site answers only requests that come through Cloudflare, with its bot and DDoS protection. Direct requests to the hosting provider get a 403. |
| Escaped market data | Market titles and other text from venues are treated as untrusted, and are escaped before they're shown. |
| Locked-down browser features | Camera, microphone, location, payment and USB access are switched off for every page. |
| No tracking by default | No third-party code loads unless you accept analytics. |
| Private dashboard | The dashboard is hidden from search engines. |
04Keeping your accounts safe
- Turn on two-factor authentication on every venue account and on your email.
- Use a unique password for each account, ideally from a password manager.
- Check the execution log. If you see an order you didn't expect, turn off auto-execute, revoke the keys at the venue and contact us.
- Halcira will never ask for your venue password, your seed phrase or a key with withdrawal rights.
05Report a vulnerability
Email [security@yourdomain.com] with the page or endpoint, the steps to reproduce, and what an attacker could do. Our contact details are also in /.well-known/security.txt.
- We'll reply within [e.g. 3 business days] and keep you updated until it's fixed.
- If you research in good faith and follow this page, we won't take legal action against you.
- Please don't access other people's data or accounts, place real trades on someone else's account, run denial-of-service attacks or social-engineer us.