Security

DealXD collects as little personal data as it needs, and protects what it keeps with layered controls. This page summarises those measures and explains how to report a vulnerability.

• Encryption in transit: all traffic to dealxd.com and our API is served over HTTPS (TLS).
• Passwords: stored only as salted, one-way PBKDF2 hashes, never in plain text. You can also sign in with Google or GitHub, so we never see a password at all.
• Data minimisation: for reviews we store a one-way hash of the submitter's IP address instead of the address itself; deal views and claims are anonymous counters.
• Soft deletion and backups: removed content disappears from the site immediately, and backups are access-controlled.

• Administrative tools require authentication with expiring access tokens; public endpoints are read-only or narrowly scoped.
• Rate limiting on sign-in, review posting and deal claims protects against brute force and spam.
• Input is validated on the server, and database access uses parameterised queries.

“Get Deal” buttons send you to the official site of the brand, sometimes via an affiliate tracking domain. DealXD will never ask for your banking password, card number or one-time codes.

If you receive an email or message claiming to be from DealXD that asks for credentials or payment details, do not respond. Forward it to [email protected].

We welcome reports from security researchers. If you believe you have found a vulnerability, email [email protected] with:

• a description of the issue and its potential impact;
• steps to reproduce it, including URLs and requests;
• your contact details, so we can follow up and credit you if you wish.

We will acknowledge your report within 3 business days and keep you updated until it is resolved.

To stay within good-faith research, please:

• only test against your own accounts and data, and never access or modify other users' data;
• avoid denial-of-service testing, spam, social engineering and physical attacks;
• give us reasonable time to fix an issue before disclosing it publicly.

We will not pursue legal action against research carried out in good faith under these guidelines. See also our Terms of Service.