Isolated account boundaries
Realnaps maintains strict architectural isolation between public end-user customer accounts and internal platform administration. Credentials issued for end-user API access cannot interact with internal management boundaries.
All API access requires cryptographically validated bearer tokens or provisioned x-api-key headers, verified at the API gateway on every request.
Credential handling & secret protection
Passwords are encrypted using industry-standard bcrypt/Argon2 hashing algorithms and are never stored in plaintext.
Server-side secrets, database credentials, encryption keys, and third-party provider tokens are stored strictly in secure server environment variables and are never bundled into client-side web applications.
Operational controls & rate limiting
All API routes implement intelligent rate limiting and burst protection to prevent denial-of-service disruptions and preserve ultra-low latency for active integrations.
Database operations and prediction pick ingestion are backed by transactional consistency and automated worker queues to ensure zero dropped predictions during high-volume match rounds.
Responsible vulnerability disclosure
If you discover a security vulnerability or anomalous behavior, please report it promptly to support@realnaps.com with “Security Report” in the subject line. We appreciate responsible disclosures and investigate reports promptly.