Security Policy

1. Account protection

Passwords are never stored in plain text — only a bcrypt hash is kept. You can add a second authentication factor (TOTP) and register passkeys for phishing-resistant sign-in.

We track sign-in events and trusted devices, and you can review and revoke sessions and devices at any time from Security settings.

Sensitive account changes — enabling two-factor authentication, registering a passkey, staff account provisioning — go through a verification step before they take effect.

2. Data encryption

Traffic to and from NairaCoders is encrypted in transit (HTTPS/TLS). Two-factor secrets and other sensitive fields are encrypted at rest before they are written to the database.

Session cookies are signed and scoped, and rate limits apply to sign-in, registration, and other sensitive endpoints to slow down credential-stuffing and brute-force attempts.

3. Payment and escrow security

Card and mobile-money payments are processed by PCI-compliant payment processors (currently Paystack and Flutterwave); NairaCoders does not store raw card numbers.

Milestone funds are held in escrow and only released to a provider when the employer approves the deliverable or a dispute outcome directs release. Every funding, release, and refund is recorded as an immutable ledger entry.

Webhook notifications from payment processors are verified against a signed secret before they are trusted, and processed idempotently so a retried webhook cannot double-credit an account.

4. On-chain escrow

Where a contract uses on-chain escrow, funds are held by a smart contract rather than solely by NairaCoders. These contracts go through internal review before deployment; we have not yet published a third-party audit report, and we will update this page once one is completed.

5. Dispute integrity

SabiResolve, our mediation-first dispute process, keeps evidence, messages, and jury deliberations tied to the case so outcomes stay auditable. Jury selection and voting are designed to limit any single party's ability to influence an outcome, and outcomes can be appealed through the process described in our Terms of Service.

6. Infrastructure

Access to production systems and data is role-based and logged. Administrative actions that affect funds, disputes, or accounts go through an approval workflow rather than a single person acting unilaterally.

We monitor for suspicious activity and keep audit logs of security-relevant events across the platform.

7. Report a vulnerability

Found a security issue? Email security@nairacoders.com with steps to reproduce it. We ask that you avoid accessing, modifying, or deleting other users' data, and that you do not test against production accounts or funds beyond what is necessary to demonstrate the issue.

We aim to acknowledge reports promptly and will let you know once an issue is resolved.