Security

WheelOfSpins protects your wheels and account security with HTTPS encryption, strict browser security headers, signed session tokens, owner-scoped data access, and cryptographic randomness that runs in your own browser.

HTTPS encryption and browser security headers

Every page and request is served over HTTPS with modern TLS encryption, and HTTP Strict Transport Security (HSTS) tells browsers to always use the secure connection. The site also sends a Content Security Policy, X-Frame-Options to block clickjacking, X-Content-Type-Options to prevent content sniffing, a strict Referrer-Policy, and a Permissions-Policy that disables camera, microphone, and location access.

  • HTTPS everywhere with HSTS
  • Content Security Policy and anti-clickjacking headers
  • Camera, microphone, and location access disabled

Cryptographic randomness in your browser

Each spin result is chosen in your browser with the Web Crypto API (crypto.getRandomValues), which provides cryptographically secure random numbers. In the rare case a very old browser does not support Web Crypto, the wheel falls back to the browser's standard random function so it keeps working. Results are never decided on our servers, and entry weights you set yourself are the only thing that changes the odds.

  • Web Crypto API random selection
  • Spin results calculated on your device
  • Odds change only through weights you choose

Account security and access control

Passwords are stored only as bcrypt hashes, never in plain text. After you sign in, your session is kept in signed JSON Web Tokens stored in HTTP-only cookies that page scripts cannot read. Every request for saved wheels is checked against your account, so you can only view or change wheels you own, and public share links expose only the wheels you choose to publish.

  • Passwords stored as bcrypt hashes
  • HTTP-only session cookies
  • Saved wheels restricted to their owner

Reporting a security vulnerability

We welcome reports from security researchers and users. If you find a vulnerability, please send the details through our contact page, including the affected URL, the steps to reproduce the issue, and its potential impact. Please give us reasonable time to investigate and fix the problem before sharing it publicly.

  • Report through the contact page
  • Include steps to reproduce
  • Responsible disclosure appreciated

Frequently asked questions

How does WheelOfSpins keep spins fair?

Spin results are chosen in your own browser using the Web Crypto API, so they cannot be changed by our servers. The only way to change the odds is to set entry weights yourself.

Can other users see my saved wheels?

No. Saved wheels are linked to your account and every request is checked against it. Other people can only open wheels you choose to share with a public link.

How do I report a security vulnerability?

Use the form on our contact page and include the affected URL, steps to reproduce, and the impact you observed. We review every valid report.