Security at tf2cart
tf2cart combines Steam account safeguards, web security controls, transaction idempotency, and conservative balance accounting to reduce trading risk.
Last reviewed: July 15, 2026
tf2cart is independent and is not affiliated with Valve or Steam. Steam sign-in uses official Steam OpenID on steamcommunity.com; tf2cart never asks for your Steam password.
Report a security issueSteam authentication
Sign-in redirects to official Steam OpenID on steamcommunity.com. tf2cart does not receive or store your Steam password. Users should verify the official bot profile and every offer's item count before accepting.
Session and browser protection
Production sessions use signed Secure, HttpOnly, SameSite cookies. High-risk admin writes require a session-bound CSRF token. Content Security Policy, frame restrictions, HTTPS enforcement, and restrictive browser permissions reduce common web attack impact.
Order and balance integrity
Buy stock and sell payout liquidity are reserved before pending trades. Ledger writes, payment events, webhooks, refunds, and completion transitions use idempotency controls to reduce duplicate keys, credits, debits, or payouts.
Payment verification
Invoices identify the required token, network, address, and exact amount. Blockchain events are matched to active invoices and stored with transaction details. Unrelated wallet transfers are recorded for review rather than assigned automatically.
Failure handling
The system preserves last-known valid stock when Steam refreshes fail, retries recoverable operations, keeps uncertain Steam offers under review, and avoids refunding when acceptance status is unresolved. Failed swaps and withdrawals release or restore locked balance through ledger entries.
Protect yourself
Never share a Steam password, Steam Guard code, wallet seed phrase, or private key. Confirm the token, network, destination, exact amount, official bot, and trade contents. Contact support when an order state or transaction does not match what you see on-chain or in Steam.
Security reports
Report suspected vulnerabilities privately through the contact page. Include clear reproduction steps and avoid accessing other users' data, disrupting production, or moving funds or items without authorization.