Security

Sign-in supports Google OAuth and email/password with leaked-password screening. Sessions are scoped to your device, and you choose whether to stay signed in.

Every table enforces row-level security. You can only read your own profile, your orders, your conversations and public listings. Contact details are visible only to an active trade or chat counterparty.

Order prices and totals are recalculated on the server from the published listing, so they cannot be tampered with from a browser. Orders start unpaid and only advance once our payment provider confirms the charge through a signature-verified webhook.

Role changes, payment status changes and listing deletions are written to an append-only audit log. Traffic is served over HTTPS with strict transport security and hardened response headers.

Found a security issue? Contact us on WhatsApp at +254 185 053 019 with steps to reproduce. Please do not publicly disclose before we have responded. We do not pursue researchers who act in good faith and avoid accessing other users’ data.