Security
Security
What this system holds, what it does not, and how to report a vulnerability.
Reporting a vulnerability
Email security@predicta.markets. Include enough detail to reproduce the issue: a URL, a request, and what you observed.
Good-faith research is welcome and will not be treated as a breach of the acceptable-use policy. Please do not run automated scanning at volume against the public API, do not access or modify data belonging to anyone else, and give us a chance to fix an issue before publishing it.
There is no bug-bounty programme and no payment. Saying so is more useful than leaving it ambiguous.
What there is to lose
This deployment has no end-user accounts, no passwords, no stored payment details and no customer funds. The demonstration wallet exists only in the visitor’s own browser and is never transmitted to us. Compromising this environment does not expose an end user’s money or credentials, because neither is here.
What it does hold is a normalized market catalogue, price history, and the credentials used to read public provider APIs.
How secrets are handled
No API key, provider credential or database URL is present in browser code. Anything a browser can read is treated as public by construction, and the values a partner would care about are read only in server contexts.
Webhook signing secrets are not yet issued. Signing requires a secret recoverable for verification, which means encryption at rest with a key held outside the database: storing a hash would make signatures unverifiable, and storing plaintext would make the database the whole attack. Until that key management exists, the webhook sender is deliberately not wired, and events queue durably rather than pretending to deliver.
Outbound HTTP to a partner-supplied URL is likewise gated on an egress allow-list and a private-range block, because a sender that will POST anywhere is a server-side request forgery primitive handed to whoever registers an endpoint.
What Predicta is not certified for
Predicta holds no security certification. It has not completed SOC 2, ISO 27001 or any equivalent, has not commissioned a third-party penetration test, and has no independent audit of any kind. It is not a licensed financial institution, exchange or gambling operator, and it is not registered with any financial or gaming regulator.
A production integration with a regulated operator will require several of the above. They are part of the commercial conversation and none of them is claimed here.