Security policy

Protecting research and delivery

OracleIQ minimizes identity collection, hashes API keys, signs outbound webhooks, and never asks for trading keys or wallet signatures for research access.

Report a vulnerability

Send a concise report to security@oracleiq.tech with impact, affected route, reproduction steps, and a safe proof of concept. Do not access other users’ data, disrupt production, or publish before coordinated remediation.

Credential handling

API keys are displayed once and stored as SHA-256 hashes. Webhooks are signed using HMAC-SHA256 over timestamp.body. Recovery keys grant access to private research and must be protected like passwords.

Infrastructure controls

Production data persists on a Railway volume, secrets remain environment variables, public API keys are revocable and rate-limited, and admin analytics requires a separate server secret.

Scope

The web application, public backend API, Telegram bot, PWA push delivery, and oracleiq.tech properties are in scope. Third-party provider infrastructure and social-engineering attacks are out of scope.