Home › Documentation › Accounts & security
Accounts & security
Every account is its own workspace
PumpRug serves many users from one process, and isolation is enforced at every layer rather than assumed:
| What | How it is kept separate |
|---|---|
| Launches, wallets, queue, campaign | Every database query filters on the owner's id. Requesting another user's launch by its exact id returns 404. |
| Wallet keys | Each wallet row records its owner directly, so a lookup cannot cross accounts through a stale reference. |
| Live events | The websocket handshake is authenticated and joins a private per-user room. You receive your events and no one else's. |
| Uploaded images | Stored under a per-user directory with random filenames. |
| Campaign runner | Keyed by user, so one person's stop, start or queue position never touches another's. |
How private keys are stored
Your funding wallet is generated on the server when your account is created; launch wallets are generated per launch. Both sets of keys are encrypted with AES-256-GCM before they touch the database, using a secret held only in the server's environment and never stored alongside the data. Possession of a database dump or backup does not yield spendable keys.
Google Sign-In
Where enabled, one button both signs up and signs in. Google issues the browser a signed ID token; the server verifies its signature against Google's published keys and checks the algorithm, issuer, audience, expiry and that the email is verified, before trusting any part of it. A token minted for a different application is rejected.
Why linking is sometimes refused
If you sign in with Google using an email that already belongs to a password account, PumpRug refuses and asks you to log in with your password first and link Google from your profile.
That refusal is deliberate. Nothing verifies the email typed at password signup. If a matching address linked accounts automatically, someone could register using your email address, wait for you to click Sign in with Google, and Google would drop you into their account — which they still hold the password to — and every lamport you then deposited would land in a wallet they can export. Proving control of the existing account first closes that door.
Related rules: a Google identity cannot be linked to two accounts, and unlinking Google is refused while it is your only way in.
Abuse limits
Signups, logins and general API traffic are rate-limited per IP address. Per-account ceilings cap concurrent launches and queue size.