Skip to main content

Header

Account Recovery & Session Security

Account security on BDX.market extends beyond initial password entry and 2FA challenges. Maintaining safety across active user sessions requires robust session isolation, intelligent password reset protections, rate limiting on sensitive actions, and strict anti-abuse safeguards.

This document details BDX session management practices, account recovery workflows, automated rate-limiting protections, and notification security.

1. Account Recovery & Password Resets​

Account recovery on BDX provides secure fallback mechanisms if you forget your password or lose access to your primary device.

Password Reset Flow​

  1. Request Reset: On the login page, click Forgot Password? and enter your registered email address.
  2. Email Verification Link: BDX dispatches a secure password reset link to your email. Password reset links expire after 60 minutes and can only be used once.
  3. Set New Password: Follow the link, create a strong new password, and confirm.
  4. Automatic Session Termination: Completing a password reset automatically logs out all other active sessions across all devices for your protection.

Emergency 2FA Recovery​

If you lose access to your authenticator app:

  1. On the 2FA login prompt, select Use Recovery Code.
  2. Enter one of your saved 8-character recovery codes (e.g., XXXXX-XXXXX).
  3. Once logged in, go to Account -> Security -> 2FA to reset your 2FA configuration or generate a new set of recovery codes.

2. Session Security & Multi-Device Protection​

BDX applies strict session security standards to protect your account while you navigate the marketplace:

  • Automatic Session Invalidation: Logging out terminates your active session immediately on our servers.
  • Session Protection on Security Changes: Changing your password, updating 2FA settings, or updating your account email automatically refreshes your login session to prevent unauthorized access.
  • Data Protection: Sensitive information (such as raw passwords or payment proof tokens) is never stored in browser session storage or error logs.

3. Rate Limiting & Abuse Prevention​

To defend against automated bot attacks, credential testing, and server overload, BDX enforces strict rate limits across sensitive account actions:

  • Login Attempts: Limited to prevent brute-force password guessing.
  • 2FA Code Submission: Rate-limited to block automated passcode entry.
  • Password Reset Requests: Limited per minute to prevent email spam.
  • Payout & Order Submissions: Protected against rapid duplicate clicks.

When a limit is exceeded, BDX temporarily pauses further attempts and displays a message asking you to wait a short period before trying again.

4. Smart Email Notification Controls​

High-volume notification dispatch can clutter your inbox. BDX uses intelligent email controls to manage notification flow:

  • Urgent Account Alerts: Password resets, 2FA changes, payout confirmations, and dispute updates are dispatched immediately.
  • Chat Notification Controls: Messages in active order chats send an email notification if you are offline. If you receive multiple messages in a short window, email notifications are throttled to prevent inbox spam.
  • Active Presence Detection: If you are currently online and active on the BDX website, chat email notifications are automatically suppressed in favor of instant in-app alerts.

5. Security Headers & Browser Safeguards​

BDX enforces modern browser security protections on every page:

  • Clickjacking Defense: Prevents malicious third-party websites from embedding BDX pages in hidden frames to trick users.
  • MIME-Sniffing Defense: Enforces strict asset types so uploaded files cannot execute malicious scripts.
  • Referrer Privacy: Strips internal query details when following external links to protect user privacy.
Last updated on