Security

What is actually true here

This site has no server, no account and no stored credential, so there is nothing an attacker could take from it. The sign-in form validates nothing and protects nothing. Never type a real password into it.

The model the product describes

The security described on the home page is the model a card issuer of this kind would run. Stated plainly, so it is clear what is being claimed and what is not:

• Card freeze applied at the authorisation layer, so a transaction attempted one second after locking is declined rather than queued and reversed later.
• Only the last four digits printed on the metal; the full number and CVV shown in the app and rotatable after a breached checkout.
• Biometric sign-in where the device attests it recognised you and the fingerprint itself never leaves the phone.
• Multi-factor authentication on sign-in and on any change to payout details.
• Transport and at-rest encryption, with keys held in hardware modules.
• Monitoring that scores each authorisation in-flight and can hold one for confirmation.
• Notification on every authorisation, so an unrecognised one is visible in seconds rather than at the end of the month.
• Device management, so a lost phone can be revoked without cancelling the card.
• Crypto held in segregated cold storage, never lent, staked or rehypothecated.

Reporting something

On a real service this is where the fraud line would sit, staffed continuously and answered by a person. For this demonstration, ayuda@avora.example reaches the project and nothing more.