Signed login tokens
01A long, private signing key
Every login token is signed. The server refuses to start if its private signing key is too short, making forged tokens much harder to create.
How we protect the service
POP-SPOT has 7 safeguards
These safeguards are used in the live service to protect visitors, accounts, and content owners.
Protected passwords
02Passwords are never stored as plain text
Passwords are converted with BCrypt before storage. Even if stored data is exposed, the original password is deliberately expensive to recover.
Approved websites only
03Requests are limited to trusted domains
The API accepts browser requests only from POP-SPOT and approved preview addresses, reducing the risk of a fake site using a visitor’s session.
Repeated attempts are limited
04Limits on login and verification attempts
Fast repeated login attempts and email-code requests are restricted so automated guessing cannot continue without delay.
Privacy choices are separated
05Age check and separate consent
Terms and privacy consent are requested separately. People under 14 cannot create an account, in line with the Korean privacy policy.
Reports reviewed within 24 hours
06Disputed listings are hidden first
A copyright or accuracy report hides the listing while the operator reviews it. Permanent deletion happens only after review to reduce malicious reports.
Encrypted connections
07HTTPS from the browser to the server
Traffic between visitors and the service is protected with HTTPS, including the connection to the backend server.
Read the details
The Terms and Privacy Policy explain these measures. Report copyright or listing errors from the pop-up page or by email; we aim to review them within 24 hours.