Security Center | CoinBelieve Legal

Cryptographic credential hashing, 2FA device trust, anti-phishing, and disclosure.

Zero-Trust Phishing Advisory

CoinBelieve personnel, moderators, and support engineers will NEVER solicit your account passwords, two-factor authentication codes, or external private keys. Any such solicitation is fraudulent.

1. Security Architecture & Controls

Credential Storage: Passwords are secured utilizing memory-hard Argon2id / Bcrypt algorithms with unique cryptographic salts.
Two-Factor Authentication (2FA): Time-based One-Time Password (TOTP) protocols complying with RFC 6238. Trusted device authentication tokens (cb_2fa_trust) expire after 30 days.
Content Security Policy (CSP): Strict headers blocking unauthorized third-party script injection, iframe clickjacking (frame-ancestors 'self'), and cross-site scripting (XSS).

2. Responsible Disclosure & Bug Bounty Program

We welcome security researchers to inspect our public interfaces. Reports detailing security vulnerabilities should be submitted directly to [email protected]. We commit to acknowledging receipt within 24 hours.