Keeping your StreamBoost account secure

Your StreamBoost account holds a spendable balance, which makes it worth protecting properly. This article covers what the platform does on your behalf, what it deliberately never stores, and the small number of things only you can do.

What StreamBoost does

Passwords are hashed, never stored

Passwords are stored as bcrypt hashes. The plaintext is never written to the database and never written to a log. Nobody operating StreamBoost can read your password, which is also why a reset produces a new password rather than telling you the old one.

Sessions live on the server

Signing in creates a session record on the server and gives your browser an opaque token. The token is not your identity and carries nothing about you — it points at a row that can be revoked.

That matters practically: signing out deletes the server-side session, so the token stops working immediately rather than merely being forgotten by your browser.

• HttpOnly — page JavaScript cannot read the token.
• Secure — sent only over HTTPS, derived from how the request actually arrived.
• SameSite — not sent with cross-site requests, so another site cannot act as you.

Email verification and resets

Password reset and email verification links are single-use, expire quickly, and are stored only as hashes — a read of the database does not yield a usable link. Changing your password signs out your other sessions, which is what makes a password change an effective response to a compromise.

Sign-in notifications

Sign-in verification email includes the address and browser the attempt came from, specifically so an unfamiliar one stands out to you. If you receive one you do not recognise, change your password and then open a ticket.

Automated abuse is blocked before an account exists

Account creation requires a proof-of-work challenge and evidence that first-party JavaScript actually ran, so a request-only script cannot sign up by replaying captured values. Authorisation values are server-issued, single-use and replay-resistant.

Rate limiting is applied across several dimensions, and the identifiers it works on are hashed rather than stored raw.

What StreamBoost deliberately does not store

• Card numbers, CVCs or bank credentials — these are entered on the payment processor's page and never reach this application.
• Your password in any readable form.
• Location, contacts, camera, microphone or files.
• Advertising identifiers or cross-site tracking data.
• Persistent browser fingerprints.

What is yours to do

1. 1

   Use a password you do not use anywhere else

   Credential reuse is how most account takeovers actually happen — not by breaking a site, but by trying a password leaked from another one. A password manager makes a unique password per site the easy option.

2. 2

   Keep your email address current and secured

   Your email can reset your password, so it is effectively the master key to your account. Secure it at least as well as this one, and update it here if you change it.

3. 3

   Verify your email

   An unverified address means password resets, security notices and support replies all fail quietly at the moment you need them most.

4. 4

   Sign out on machines you do not control

   Signing out revokes the session on the server, so the token left behind on that machine is dead rather than merely inconvenient.

5. 5

   Treat unexpected sign-in mail as worth investigating

   It costs a minute to check and change a password. It costs a balance not to.

Reporting a security problem

If you think you have found a security issue, report it privately through a support ticket rather than publicly, and include enough detail to reproduce it. Please do not run automated scans or anything that would degrade the service or touch another account's data.