Security fixes from an audit of sign-in, accounts and data access

On 25 and 26 September we audited how Quantis Trade handles sign-in, accounts and access to your data, and fixed the issues we found. We don't publish the details of individual security issues, but here is what changed for you.

Account protection. We fixed sign-in and registration security issues found in the audit. Registering with an email address that already has an account now tells you so, and points you to Google sign-in if that's how the account was created. Developer tools and internal API documentation that were reachable on the live site are now switched off there.

Password reset that works, once. Reset emails now link to a page where you set a new password. Each link works once and expires after 30 minutes, and asking for a new link replaces any earlier one. If our email service isn't available, the forgot-password page says so and tells you how to contact us, instead of claiming an email is on its way. We also removed wording from those pages that described security checks we don't run.

Rate limits. Attempts to sign in, register and reset a password are rate-limited using a shared store, so the limits hold across restarts. If that store can't be reached, those pages say the service is temporarily unavailable rather than dropping the limits. Research requests are rate-limited per account too.

Your data stays yours. We closed several places where the server didn't fully check that the item being viewed, changed or deleted belonged to the signed-in account. Public community posts and shared strategies no longer include the author's email address; they show your name, or "Quantis trader" if you haven't set one.

Paid features are charged to the right account. Playbooks and deep research now debit the balance of the account that runs them, and paid-plan features are checked on the server, not just in the browser.