Security
Built so a leaked database would not leak your key
The directory is public by design. What needs protecting is your key, your account and the private notes around each listing. This is how each is handled.
Keys are stored as hashes
A key is shown once, when you create it. We keep a SHA-256 hash and the last four characters, so a key cannot be read back from our database by you, by us or by anyone who copied it.
Test and live are separate
A test key returns sample listings and never reads live rows. Live keys are issued only after a person has read what you are building.
Only public fields leave
The API sends an allow-list of fields for each resource. Contact emails, review notes, claim evidence and who submitted a listing are not on it, and a check in our build fails if one ever is.
Every key is rate limited
Limits are per key, so one integration cannot starve the others. A key over its limit gets a clear answer and a time to retry.
No passwords
People sign in to Arena54 with Google or X. We hold no passwords, so there are none to leak.
Staff actions are recorded
Approving a request, revoking a key and changing a setting are written to an audit log whose entries are chained, so an edited or deleted entry is detected.
Secrets we hold are encrypted
Credentials for the services Arena54 itself uses are encrypted at rest and are never sent to a browser, including ours.
Reporting a problem
If you find a weakness, write to hello@arena54.com with what you did and what you saw. Please give us time to fix it before you publish. If you think a key has leaked, revoke it in the dashboard first: that takes effect on its next request.
Personal data
What we collect and why is in the privacy policy.