Security

Authentication

Firebase Authentication handles sign-up, email verification, Google OAuth, and password reset. Sessions use industry-standard tokens.

Roles

User and admin routes are separated. Admin panels require elevated roles — not available on public pages.

Dashboard quiz

Member assessments live behind login — not exposed on the public site.

Best practices

• Verify email before funding a live account
• Use unique passwords and enable recovery email access
• Log out on shared devices
• Report suspicious login activity to support

Reporting

Security issues: support@swamarket.com with subject "Security report".