Security

Application controls

• Clerk protects dashboard routes and API ownership checks isolate every store.
• Shopify offline tokens are encrypted with AES-256-GCM before PostgreSQL persistence.
• Shopify and Stripe webhook signatures are verified before processing.
• Webhook IDs and job deduplication make retries idempotent.
• Security headers, HTTPS-only production URLs and timing-safe scheduler authentication reduce common web risks.

Data controls

Shopify external IDs are unique within a store while internal CUIDs prevent cross-tenant collisions. Secrets are supplied through the hosting provider and are never committed. Database backups, encryption at rest and access logging must be enabled in the selected PostgreSQL provider.

Report a vulnerability

Please send a concise reproduction and impact assessment to security@boostaicommerce.app. Do not access data that is not yours or disrupt production systems.