Skip to content
Terminal
DRAFT, pending counsel review. This page is not in effect until counsel reviews it and it is published.

Security

Version: 2026-11-01 draft

Updated 1 November 2026.

Effective: [Effective date: set when published]

This page says how Terminal protects your account and your data, what is not finished yet, and how to report a security problem. Virtus Blockchain Labs LLC runs Terminal.

Summary. Passwords, session tokens, and API keys are stored only as hashes. Tokens for connected accounts are encrypted. We never see your card number. Backups are not running yet. To report a problem, write to contact@tokensmarketcap.com.

Your account

  • Passwords. We store a salted scrypt hash of your password, never the password itself. Nobody at Terminal can read it.
  • Sessions. The sign-in cookie holds a random token. We store only a hash of that token, so a copy of our database cannot be used to sign in as you. Signing out ends the session on the server.
  • Sign-in limits. Sign-in, sign-up, and password reset have attempt limits. Reset links last one hour. Email confirmation links last two hours.
  • Google and GitHub sign-in follow those providers' own security. We never receive your Google or GitHub password.

Keys and connections

  • API keys are shown once, when you create them. We store a hash, the first characters, and the last four, so you can tell your keys apart. We cannot show a key again.
  • AI assistant connections (MCP) use short-lived access tokens. We store only hashes of those tokens.
  • Tokens for connected accounts, webhook secrets, and bot tokens are encrypted with AES-256-GCM before they are stored. The encryption key is kept outside the database. A connection token saved before encryption was turned on stays readable on the server until it is re-encrypted. [Owner: confirm the re-encryption script has run on production, then delete this sentence.]
  • Webhooks that Terminal sends to a webhook address you add are signed with a Terminal-Signature header, so your software can check that a message came from us. Alerts sent to Discord, Telegram, or a browser's push service do not carry that header.

Payments

Stripe handles card payments. You type your card into Stripe's form, and we never see or store the full card number. We store the invoice, the amount, and whether it was paid.

Before a USDC payment through x402, we check the paying address against the US Treasury sanctions list, and the country of the request against embargoed regions. Before a marketplace listing or a paid marketplace subscription, we check the account's name and email against the same list, and the country of the request. These checks run on our own server.

The service

  • Encrypted transport. The site is served over HTTPS.
  • No outside scripts. Our pages load no scripts, fonts, or images from other companies, and a strict content security policy blocks them.
  • Fewer copies of addresses. Rate limits store a hash of your IP address, not the address. Usage counts store no IP address and no email address.
  • Access. The people who run the service and the automated build agents the company runs on the server can reach the production server and database. [Owner and counsel: confirm this sentence.]
  • Updates. The server's operating system installs security updates on its own, once a day. We check the libraries the app uses for published security advisories and newer versions by hand, and keep a dated record of each check. We aim to run this check once a month. Nothing alerts us to a new advisory between checks.

Backups

The tools for a nightly backup, an encrypted off-site copy, and a weekly test restore are built. No nightly backup runs yet, on the server or off it. Until backups run, we cannot promise that data can be restored after the loss of the server. [Owner: update this paragraph when off-site backups run (H-08).]

If something goes wrong

If we learn that someone got your personal information without permission, we tell you by email without unreasonable delay, and within the time the law sets. That includes the notice New York's SHIELD Act requires (General Business Law section 899-aa), and the notices other states require. We also tell the regulators the law names.

Report a security problem

If you find a security problem in Terminal, write to contact@tokensmarketcap.com with "Security" in the subject line. Include what you found, how to reproduce it, and what it could expose. Our security.txt file has the same contact.

Please:

  • Give us a reasonable time to fix the problem before you tell anyone else
  • Do not read, change, or delete other people's data. Use your own accounts to test.
  • Do not run tests that slow or stop the service, and do not send spam or phishing
  • Do not use social engineering on us or on other people

If you follow these rules and act in good faith, we will not take legal action against you for that research, and we will work with you to understand and fix the problem. [Counsel: confirm this safe-harbor sentence.] We do not run a paid bug bounty.

What you can do

  • Use a long password that you do not use anywhere else, or sign in with Google or GitHub
  • Keep API keys out of public code and shared files. Delete a key you no longer use.
  • Tell us at once if you think someone else used your account

No system is perfectly secure. This page describes what we do. It is not a promise that nothing will go wrong.