Security
How your account and images are protected
How Graded Card Value protects accounts, images and inventory data: private storage, short-lived signed links, owner-scoped access, fail-closed features and responsible disclosure.
This page describes practices maintained by Graded Card Value. It is not an independent audit, certification or compliance attestation.
Account access
- Authenticated identity is always taken from the verified session, never from values supplied by the browser.
- Sign-in responses avoid revealing whether an unrelated account exists.
- Sessions are restored on return and cleared completely on sign-out.
- Redirect destinations are validated so a sign-in link cannot send you off-site.
Your images
- Uploads are stored in private storage, not in a public bucket.
- Images are served through short-lived signed links tied to your account.
- Nothing in your inventory is publicly browsable or indexed by search engines.
- Uploads are validated for type, size and content before they are accepted.
Your data
- Every read and write is owner-scoped and enforced at the database layer, not just in the interface.
- Deletions are confirmed explicitly, and archive is offered as the reversible option.
- Sensitive administrative changes are recorded as audit events.
How we ship
- Features that depend on unverified configuration stay disabled by default rather than degrading silently.
- Service credentials are never present in browser code or public environment variables.
- Type checking, linting, contract validation, automated tests and coverage thresholds run before a build is accepted.
Reporting a vulnerability
If you believe you have found a security issue, email info@gradedcardvalue.com with the subject line “Security report”. Please include enough detail to reproduce the issue, and give us a reasonable opportunity to respond before disclosing it publicly. Do not access, modify or delete data belonging to anyone else while testing.
Your privacy controls
You can request an export or deletion of your account data at any time. See the privacy notice for what we collect and how long it is retained.