Security

Account & authentication

• • Email + password, phone OTP, and Google OAuth supported.
• • Passwords hashed with industry-standard algorithms; never stored in plaintext.
• • Sessions auto-rotate. All cookies are HttpOnly and Secure in production.
• • No anonymous sign-ups.

Data access (RLS)

Every database table enforces row-level security (RLS). Users can only read or modify rows they own, and roles are stored in a separate user_roles table checked through a SECURITY DEFINER function — this prevents privilege-escalation attacks that exploit client-side role checks.

NID verification storage

NID images are stored in a private storage bucket accessible only to the uploader and our verified moderation team. NID numbers are never exposed via any public API or listings view. Verification status is the only thing other users see.

We hold no customer funds

resale.bd operates no escrow, wallet, or trust account and never takes custody of buyer or seller money. Deals settle directly, in person. Instead of holding funds, we run an AI Scam Shield that scores every listing for fraud risk, screens conversations for scam patterns, and routes high-risk ads to human review. Risk scores and moderation decisions are audit-logged.

Responsible disclosure

Found a vulnerability? Email security@resale.bd with reproduction steps. We commit to a first response within 48 hours and will publicly acknowledge researchers who follow coordinated disclosure. Please do not test on real user accounts other than your own.

In scope: *.resale.bd, our mobile apps, and our edge functions.
Out of scope: social-engineering, physical security, third-party integrations (bKash, Nagad, Google OAuth).