Security

Effective 25 September 2026

How graspy protects your data

• No passwords. You sign in with an 8-digit code by email. A code expires in 10 minutes, works only in the browser that asked for it, allows 5 tries (counted before checking, so parallel guessing does not help) and is stored only as a keyed hash.
• Sessions live in a Secure, HttpOnly, SameSite cookie that page scripts cannot read, for 30 days. Only a hash of the session token is stored. You can sign out on every device at once.
• Encryption. HTTPS everywhere, with HSTS. Workspaces and market statistics are encrypted at rest with AES-256-GCM, bound to their record, on top of the database provider's encryption.
• Strict browser policy. A content security policy allows only graspy's own scripts, which blocks injected code. The app is only sent to approved accounts.
• Abuse protection. Rate limits on every sign-in step, a bot check on sign-up, and same-origin checks on every change.
• One admin. Admin rights are tied to a single address in the server configuration and cannot be granted from the website. Every admin action is logged.
• Least data. Market statistics are published only as per-category totals: medians for groups of 5 or more, ranges for groups of 20 or more. The underlying deal records are read in the admin's own browser and never stored by graspy.
• Nothing on SWAPD. graspy never holds SWAPD passwords and never posts to SWAPD.

Report a vulnerability

Found a security issue? Email support@graspy.app with the subject "Security", what you found and how to reproduce it. We confirm within 5 working days and keep you updated until it is fixed.

Please do not access or change other people's data, do not run denial-of-service or spam tests, and give us reasonable time to fix before telling others. If you follow these rules in good faith, we will not take legal action against you. We do not run a paid bounty programme yet.

Machine-readable contact: /.well-known/security.txt