Built secure, made to test
Crypto Flight X is designed so your security and integration teams can verify every claim before going live. Here are the controls in place and how to test them.
HMAC-signed APIs
Every server-to-server call (launch session, wallet debit/credit, webhooks) is signed with HMAC-SHA256 over `${timestamp}.${body}` using your secret key, and verified with a timing-safe comparison.
Idempotent wallet callbacks
Debit and credit calls carry an idempotency key, so network retries can never double-charge a bet or double-pay a win.
Append-only audit log
Every money and fairness event is written to an audit log protected by a database trigger that blocks updates and deletes — records cannot be altered after the fact.
Provably-fair RNG
Crash points are committed (hashed) before play and revealed after, so outcomes are independently verifiable and tamper-evident.
Row-level security
Operator and player data is isolated with row-level security policies; data access is scoped per authenticated identity, not shared globally.
Input validation
All public endpoints validate every field with strict schemas (type, length, range) before any processing or database access.
Sandbox for integration testing
Test the full flow against a simulated wallet before touching real funds:
op_sandbox_demo · key cfx_test_sk_sandbox_demo_key_001 · simulated wallet mode- • Mint a signed launch session and embed the returned token.
- • Drive debit/credit callbacks against your wallet endpoint and confirm idempotent handling.
- • Use the webhook test console to send signed
round.settledevents. - • Reveal seeds and re-derive crash points to confirm fairness.
Responsible disclosure
Found a vulnerability? Report it to security@cryptoflightx.com. We acknowledge reports promptly and work with you on a fix before disclosure. We welcome third-party penetration tests and RNG certification as part of operator onboarding.
Note: update the security contact and attach any completed RNG/penetration-test certificates before submitting to operators — compliance teams will ask for them.