OTP TRAP is designed with a strict security perimeter to guarantee privacy, prevent abuse, and keep your test secrets safe.
Virtual numbers created inside OTP TRAP are strictly internal sandbox identifiers. They are not registered with any mobile network operator or telecommunication provider.
They cannot receive incoming SMS from real devices or third-party platforms. Only HTTP POST requests authenticated with your project API key can ingest messages.
Every database query strictly enforces project ownership verification against the authenticated session or API key hash.
User A can never read, modify, or infer messages, virtual numbers, or API keys belonging to User B, preventing IDOR and unauthorized cross-tenant data access.
API keys are hashed with salted SHA-256 before persisting to PostgreSQL. The plaintext key is only returned once upon creation and cannot be retrieved later.
User passwords are encrypted with industry-standard bcrypt hashing with a strong salt work factor.
Web console authentication uses signed JWT tokens stored exclusively in Secure, HttpOnly, SameSite=Lax cookies to protect against XSS token theft.
Verification and password reset tokens are single-use, time-limited, and cryptographically random.