Security

WireGum is a small commerce operations service. The dashboard is protected by account login, server-side sessions, HTTP-only cookies, and workspace-scoped database access. Passwords are stored as salted scrypt hashes and session tokens are stored hashed, never in clear text. Login, password reset, and public checkout endpoints are rate limited.

Public storefront endpoints only return active catalog data and require an authorized storefront domain, or a read-only workspace API key, before data is returned. Checkout sessions can only be created from authorized domains.

Card collection, payment confirmation, refunds, disputes, and payout details stay in Stripe. WireGum stores Stripe IDs and checkout metadata so orders can be fulfilled, but it does not store card numbers.

Database connections use TLS with certificate verification. Merchant provider tokens, such as Shippo API keys, are encrypted at rest with AES-256-GCM before they reach the database. Provider webhooks are checked with signed Stripe events or workspace-specific webhook tokens. During the preview, connect test keys or low-risk provider accounts unless we have agreed on a production setup together.

We keep secrets out of the repository, review changes before production deploys, and prefer provider-hosted flows for sensitive steps such as payment and billing. We limit stored data to what is needed for checkout, shipping, email, support, and audit trails.

Please report suspected vulnerabilities privately to [email protected]. Include the affected URL, steps to reproduce, and impact. Do not test against data or workspaces that are not yours, and do not publish details before we have investigated.