Security

WheelOfSpins employs TLS 1.3 transport encryption, sitewide HTTP security headers, account security through owner-scoped account records, Web Crypto randomness, and operational logging to safeguard your custom wheels and browser data.

Transport encryption and infrastructure hardening

WheelOfSpins employs TLS 1.3 transport encryption, sitewide HTTP security headers, account security through owner-scoped account records, Web Crypto randomness, and operational logging to safeguard your custom wheels and browser data.

All web traffic to WheelOfSpins is transmitted exclusively via HTTPS using TLS 1.3 encryption. We enforce HTTP Strict Transport Security (HSTS), Content Security Policy (CSP) directives, X-Frame-Options SAMEORIGIN anti-clickjacking protection, and strict X-Content-Type-Options to shield session traffic and mitigate cross-site scripting.

  • Enforced TLS 1.3 HTTPS transport encryption
  • Strict CSP headers and HSTS deployment
  • Clickjacking and XSS mitigation controls

Verified client-side Web Crypto randomization

Random wheel selection relies on the browser's native Web Crypto API (crypto.getRandomValues). Unlike standard pseudo-random functions, Web Crypto provides cryptographically secure entropy generated directly on your local device, guaranteeing unbiased spin outcomes free from server-side tampering.

  • Cryptographically secure Web Crypto API entropy
  • Transparent client-side random selection execution
  • Unbiased spin outcomes with zero server manipulation

Access control and data isolation

Account authentication utilizes encrypted JSON Web Tokens (JWT) with secure attribute storage. Saved wheels belong exclusively to the account owner and are isolated behind database row-level security. Public share links expose only the specific wheel snapshot intended by the owner.

  • JWT authenticated private API endpoints
  • Row-level database access control for saved wheels
  • Strict separation of private wheels from public links

Vulnerability disclosure contact and response

We welcome vulnerability reports from security researchers and users. If you identify a security issue, please contact our security team at security@wheelofspins.com. Provide a detailed reproduction outline so we can verify, triage, and patch the vulnerability promptly.

  • Direct security email: security@wheelofspins.com
  • Timely vulnerability triage and patch verification
  • Responsible disclosure program participation

Frequently asked questions

How does WheelOfSpins ensure random wheel spins are fair?

Wheel selection runs in your local browser using the Web Crypto API (crypto.getRandomValues), providing cryptographically secure randomness that cannot be altered remotely.

Are my private saved wheels accessible to other users?

No. Private saved wheels require account authentication and are isolated to your user ID. Only wheels you explicitly publish via share links can be viewed by others.

Where should I submit a security vulnerability report?

Send security vulnerability disclosures directly to security@wheelofspins.com with steps to reproduce the issue. We review all valid security submissions.