01security
Reporting a vulnerability
Write to the store with what you found. A person reads every report, and we reply as soon as we can.
Security
What protects this store, and how to report a problem.
The machine-readable version of this page is /.well-known/security.txt (RFC 9116). This is the human one.
02security
What to include
The product or page and its version, if you know it; the steps that show the problem; what you expected and what happened instead. A short proof of concept helps.
03security
Test only your own copy
Test only on a copy of the software you installed yourself. Do not run security tests against our live servers, including this store and its demos, and never access, change or keep other people's data.
04security
Bounty and credit
There is no paid bug bounty. If you would like, we credit you by name in the fix notes when the fix ships. Please give us a reasonable window to fix the problem before you publish it; we do not threaten researchers.
05security
What we do not hold
No card numbers ever touch this server: payment is handled by Lemon Squeezy as merchant of record. We hold your order email, the license keys we issued, and the download records — nothing more.
06security
The store
Administrator sign-in requires a second factor (TOTP). Payment webhooks are verified by signature before anything is fulfilled. The origin server sits behind Cloudflare and only accepts traffic from it. The database and buyer files are backed up nightly (04:17 UTC) and copied off the server every day.
07security
The demos
Every live demo is an isolated container with sample data, reset regularly, published with a noindex header. Nothing you type into a demo reaches the store or another demo.
08security
The software you buy
Full PHP source, so you can read what runs. Each product ships with two-factor sign-in for its own admin, signed webhooks, scoped API keys (read-only keys cannot write), backups, and an audit trail — and it never phones home: it contacts this store only when you ask it to check for or install an update.
09security
Buyer portal
Sign-in is by single-use magic link to the order email. Download links are time-limited and can be re-issued from the portal.