Security at NexusZen: How We Keep Your Assets Safe

Security is the foundation of trust in any financial system. At NexusZen, we employ multiple layers of protection to ensure that your account, your mining rewards, and your personal data remain safe at all times.

Account Security

Authentication

NexusZen supports multiple authentication methods:

Email and password — passwords are hashed using bcryptjs with a cost factor of 12, making brute-force attacks computationally impractical

OAuth providers — Google, Discord, Facebook, and Telegram authentication leverages their existing security infrastructure

JWT sessions — all authenticated sessions use httpOnly, Secure, SameSite=Lax cookies with rotating token secrets

Rate Limiting

All sensitive endpoints are protected by Redis-based rate limiting:

Login — 5 attempts per 15 minutes

Signup — 5 attempts per 15 minutes

Mining operations — 10 requests per hour

Contact form — 3 submissions per hour

This prevents brute-force attacks and abuse while maintaining a smooth experience for legitimate users.

Data Protection

Encryption

All data transmitted between your browser and our servers is encrypted using TLS 1.3. Your password is never stored in plaintext. Sensitive configuration data is managed through environment variables and never exposed in the codebase.

Database Security

We use parameterized queries exclusively, preventing SQL injection attacks. The database is isolated from the public internet and accessible only through the application layer.

Mining Security

Session Integrity

Each mining session is cryptographically signed and tracked in our database. Sessions cannot be forged or extended beyond their 12-hour duration. Reward calculations are performed server-side and verified before any tokens are distributed.

Claim Protection

Our claim system uses idempotency keys to prevent double-claiming. Each claim request is logged with a unique key, timestamp, and IP address. If a claim is interrupted and retried, the system detects the duplicate and safely returns the existing result.

Smart Contract Security

While NexusZen currently operates with a centralized backend for reliability and speed, future smart contract deployments will undergo:

Professional audits — third-party security reviews by reputable firms

Bug bounty program — community-driven vulnerability discovery

Gradual rollout — features are tested on testnet before mainnet deployment

Your Role in Security

Security is a shared responsibility. We recommend:

Using a strong, unique password

Enabling two-factor authentication when available

Never sharing your account credentials

Reporting suspicious activity to our security team

Our Commitment

NexusZen is committed to transparency in security. You can read more about our security practices in the [Whitepaper](/whitepaper). [Create your secure account](/signup) and start mining with confidence.

NEXUSZEN