Argus Studio

Security

How your account, your money and the app are protected, and how to tell us from a fake. Only what is actually in place.

1. Official addresses

The site and the dashboard live only at argus-radar.com (and www.argus-radar.com). The app is downloaded only from here. News and support: the Telegram channel @argusyoutube. We never ask for your password, your two-factor code or your app key by Telegram, e-mail or phone.

2. If you were sent to a copy of the site

Our pages check their own address: opened on someone else's domain they cover themselves with a red «This is not the Argus site» warning, and the service owner is alerted about the mirror. Always check the address bar: argus-radar.com and the HTTPS lock.

3. Signed updates

Every build of the app is signed with an Ed25519 key. The app remembers the key on its first update and installs only updates with that signature: a tampered archive, a fake server or a hijacked DNS record cannot replace the files on your computer.

4. Your account

Passwords are stored only as scrypt hashes. Two-factor sign-in with an authenticator app (TOTP), one-time codes. Sign-in attempts are rate-limited. Changing the password signs out every session and revokes the app keys. Password reset is a one-time link valid for one hour.

5. Your money

The balance changes only through a ledger entry. A payment is credited only on a signed notification from the payment provider, exactly once and only for its own amount. A refund or a dispute takes the amount back.

6. The site

HTTPS only with strict HSTS, a Content Security Policy without inline scripts, no embedding in other sites, origin checks on requests with cookies, a form token and a bot trap at sign-up, per-address rate limits and Cloudflare protection against floods.

7. Report a vulnerability

Found a problem? Write to us: the contact is in security.txt (RFC 9116). Please do not publish details before it is fixed.