How we keep topbump.lol secure

topbump.lol is a pay-to-rank leaderboard — real payments and real money move through this app every day. Here's how we protect it.

Your payments are verified, not just trusted

Every price is set and locked in by our own servers the moment you submit — never by anything that can be changed in your browser. Once you pay, we independently confirm the payment happened before your listing or ad ever goes live, and every payment can only ever be counted once, no matter what.

Accounts and admin access are locked down

Login attempts are limited and monitored to shut down anyone trying to guess their way in. Sessions are cryptographically protected, so they can't be tampered with or faked.

We don't let submitted links reach anything they shouldn't

When you submit a link, we check exactly where it actually leads before our servers ever visit it — links that point at private or internal infrastructure are blocked outright, protecting both you and us.

Firewalled, rate-limited, and DDoS-protected

The whole platform sits behind a web application firewall that filters out malicious and automated traffic before it ever reaches the app. On top of that, every part of the site that handles submissions, checkouts, or logins is rate-limited to stop abuse and flooding. And if we're ever hit with a serious, sustained attack, we can flip on an emergency lockdown — an Attack Mode — that shields the whole platform within seconds.

No shortcuts on content or code safety

Every submission is checked for malicious or disallowed content before it's published. The platform is built in a way that closes off entire classes of common web attacks by design, not as an afterthought.

Uploads are never trusted as-is

Every image you upload is reprocessed on our servers — resized, cleaned, and size-checked — before it's ever shown to anyone else.

Your data and our secrets stay locked away

Database access, credentials, and every sensitive key are stored somewhere only our infrastructure can reach — never in our codebase, never exposed publicly, and not even readable by us once set. The site runs on HTTPS everywhere, with hardening in place against clickjacking and other browser-level attacks.

Found a problem?

If you believe you've found a genuine security issue, please tell us before telling anyone else — email legendprixai@gmail.com with details. We take reports seriously and will respond.