How Wolf Pay protects your money

If someone steals an API key

They can't take your money. API keys can't create payouts: the API answers 405. A refund goes straight out only to the address that paid; a refund to any other address waits for an owner or admin to approve it, no sooner than 24 hours later in live mode. Keys are stored only as SHA-256 hashes and rate-limited to 600 requests a minute.

If someone takes over a dashboard session

Two-factor authentication (an authenticator app) is required for every live money action: creating payouts, approving refunds to new addresses, changing payout schedules, creating live API keys and webhooks, and inviting teammates. The database enforces it, so every code path is covered.

New payout addresses wait 24 hours before they can receive live money, and owners are emailed about every new address, schedule change, payout and refund needing approval. A hijacked session can't redirect a payroll run before you see the alert.

Large live payouts (bringing the last 24 hours to 1,000 or more) need a 6-digit code emailed to the person sending them.

Collecting wallet addresses

Recipient links work once and expire in 7 days. Only a hash of the link is stored, the page isn't indexed and sends no referrer, and an address added through a link waits 24 hours like any other.

Webhooks and checkout

• Webhooks are signed with HMAC-SHA256 and a timestamp, so they can't be forged or replayed.
• Live redirect URLs must be HTTPS. Test payments never auto-redirect, so the checkout can't be used as a phishing hop.
• The site sends a strict Content Security Policy, HSTS, and refuses to be framed.

Behind the scenes

• Row-level security on every table; the database refuses anything a user isn't allowed to see or change.
• A double-entry ledger, checked every 15 minutes and reconciled against the custodian's balances. A shortfall pauses payouts for that business automatically.
• Every live transfer is re-checked independently right before it's sent, with platform-wide outflow limits, a per-business daily payout limit, and a kill switch.
• Dependencies are patched automatically; CI fails on high or critical advisories.

Custody

Live funds are held with a regulated custody partner, not in wallets Wolf Pay runs itself, and no private keys are stored in Wolf Pay's database.

Report a vulnerability

Signed-in users can reach us through Talk to us in the dashboard; mark the message "Security". Please give us a chance to fix an issue before disclosing it.