Security

How Halolauncher protects accounts and keys, and what is still being built.

One copy of the app per account

Every account runs in its own copy of the app, as its own system user, with its own folder. One account's copy cannot read another's files, and every request to a copy must carry that account's own secret.

Keys

Wallet keys are made on our servers and stored encrypted. They are used only by your account's copy, for what you do on the site and for the rules you set.

Sign-in

• Through Discord or Google; we never see or keep a password.
• One cookie, set only by this site, sent only over https, not readable by scripts.
• Requests from other websites are refused, so another site cannot act for you.
• Sign-in attempts are rate limited.

The page itself

No scripts from other companies, no trackers. A strict content policy only lets this site's own scripts run.

Still to come

• Two-factor codes at sign-in.
• Confirmations before withdrawals.
• Key export with a waiting period.

Until then, protect the Discord or Google account you sign in with, and keep here only what you are trading.

Reporting a problem

If you find a security issue, email support@halolauncher.xyz. Please give us time to fix it before telling anyone else, and do not access other people's accounts or data while testing.

Last changed: 2026-10-07.