System README & Safety Guide
Unused benefits shouldn't go to waste. We connect people to share surplus perks anonymously, securely, and responsibly.
🎯 Core Values
Share Generously
Turn your unused corporate perks into someone else's amazing day instead of letting them expire.
Stay Private
Your details are protected. We strip photo EXIF metadata and enforce PostgreSQL Row Level Security.
Build Community
Connect with local peers to safely swap credits, codes, passes, and stipends in a trusted space.
Do It Right
Only trade benefits you are authorized to share, and respect guidelines to keep the marketplace safe.
🛡️ "How I Would Do It If I Did It" (Safety Guide)
Tactical operational security (OpSec) guidelines for employees sharing unused perks safely:
Never Use Work Devices or Office Networks
Do not access BenefitsFromBenefits from your work computer, corporate phone, office Wi-Fi, or company VPN. Company networks keep detailed traffic logs. Always use a personal laptop or phone connected to your home network or cellular data.
Sanitize Listings & Image Uploads
When posting descriptions or pictures, never share serial numbers, exact expiration times, order receipt IDs, department names, or company sub-divisions. Keep details generalized. Share private codes or barcodes only inside our encrypted private chat after matching.
Treat Digital Goods Like Physical Transactions
For high-value digital benefit transfers (such as subscription additions, gym group passes, or software license keys), do not trade blindly online. Treat it like a physical trade: meet the buyer at a local coffee shop, activate their access or hand over the code in front of them, verify it works on their device, and collect cash or digital payment instantly.
Choose a Random Display Name
When creating your account, choose a completely random display name that has zero connection to your real name, birthday, online handles, or Slack username. Your display name is the only profile field visible to other users.
Arrange Safe Physical Hand-offs
If you are handing over a physical perk (like corporate event swag, passes, or vouchers), meet in a neutral, highly public space or municipal safe swap zone. Never invite buyers to your home or office.
Proxy Listing for Extra Corporate Security
For absolute tracking protection, share the benefit as normal with a trusted friend who does not work at your company, and let your friend list, chat, and trade it on their account. Because they have zero connection to your employer, there is no digital footprint linking back to you.
🔐 Technical Privacy & Security Architecture
Supabase Auth Isolation
Your email address is stored strictly inside Supabase Auth's internal auth.users schema, inaccessible to client-side database queries.
Row Level Security (RLS)
Database queries for chats and saved items are restricted to authenticated user UUIDs, preventing unauthorized database scanning.
Client-Side EXIF Scrubbing
Photos are redrawn onto HTML5 canvas prior to storage bucket upload, stripping GPS coordinates and camera metadata.
XSS & Input Sanitization
Client code utilizes standard DOM text node properties to safely escape user inputs, eliminating malicious script injection.
❓ Questions & Answers
Is it legal to share my employee perks?
How does anonymity work on this platform?
Does BenefitsFromBenefits log my IP address or track my location?
What should I do if someone requests my real identity?
💡 Support, Help & Suggestions
Need Help, IT Support, or Have a Suggestion?
Have a technical question, feature suggestion, bug report, or need personalized help with an anonymous trade? Email our team directly.