Security Policy

1. How we protect the platform

• Hosting: the application and primary database run in the EU (Vercel (Dublin, dub1); Supabase (AWS eu-west-1, Ireland)).
• Encryption: all traffic uses TLS. Payment-provider credentials and crypto wallet keys are encrypted before they are stored. Passwords are stored only as salted one-way hashes.
• Accounts: two-factor authentication, session review and sign-out, and short-lived sign-in links.
• Isolation: every store request is checked against the store’s team and role permissions, and sellers’ API keys are scoped to their own store.
• Abuse protection: rate limits on sign-in, checkout and public forms, and fraud rules at checkout.
• Operations: least-privilege staff access, dependency updates, error monitoring and managed backups.

2. Your part

Use a unique password and turn on two-factor authentication. Give team members only the roles they need and remove them when they leave. Keep API keys and payment-provider keys secret, and rotate them if they may have leaked. Tell us straight away if you see activity you don’t recognize.

3. Reporting a vulnerability

If you find a security issue, email [email protected] with steps to reproduce it, its impact and any proof of concept. We will acknowledge your report, keep you updated and tell you when it is fixed. Please give us reasonable time to fix it before disclosing it publicly.

Our contact details are also published in security.txt.

4. Rules for testing

When researching, please:

• test only against accounts and stores you own, or have the owner’s permission to test;
• not access, change or keep other people’s data beyond the minimum needed to show the issue;
• not run denial-of-service, spam, social engineering or physical attacks;
• not use automated scanners that generate heavy traffic;
• not make real purchases with stolen payment details or attack third-party payment providers.

Out of scope: findings with no security impact, missing headers without a working exploit, self-XSS, clickjacking on pages without sensitive actions, rate-limit bypasses that need unrealistic volume, and issues in seller-written theme code or third-party services. Report issues in a third party’s service to that party.

5. Safe harbor

If you research in good faith and follow these rules, we consider your research authorized, won’t take legal action against you for it and won’t ask the authorities to do so. If a third party takes action, we will make it known that you acted under this policy. We don’t currently run a paid bug bounty, but we are happy to credit researchers who want to be named.

6. Incidents

If a security incident affects your data, we will notify you without undue delay, as described in the Data Processing Agreement and the Privacy Policy, and notify the authorities where the law requires.