Security
Last updated: September 3, 2026
We take reasonable steps to protect your account and data. Here's an overview of our current practices.
Encryption in Transit
The entire site is served over HTTPS with a valid TLS certificate. Plain HTTP requests are automatically redirected to HTTPS.
Password Storage
Passwords are never stored in plain text. We hash passwords using bcrypt with per-password salting before storing them.
Email Verification
New registrations must verify their email address via a time-limited link before the account can log in, which reduces spam/bot signups. Admins can still suspend or remove accounts that violate our Terms of Service.
Abuse Prevention
Login, registration, and other sensitive endpoints are rate-limited to slow down automated abuse attempts.
Content Sanitization
Rich text content authored in the admin panel is sanitized against an allowlist of safe HTML tags before being stored and again before being displayed, to guard against malicious script injection.
Server Hardening
Our server firewall only allows the minimum required inbound connections, and SSH access is restricted to key-based authentication.
Reporting a Vulnerability
If you believe you've found a security issue, please tell us via our Contact page or by emailing support@tradesreference.com rather than disclosing it publicly, so we can investigate and address it.