Security requirements

Non-negotiables for every published app.

Credentials

• Client secrets, refresh tokens and webhook secrets live server-side only.
• Never log tokens. Redact Authorization headers.
• Rotate credentials immediately if a laptop, repo or CI secret is exposed, and tell us.
• MFA is enforced on your developer account before live keys are issued.

Data handling

• Store only what your feature needs, and say so in the listing.
• Delete a merchant's data within 30 days of uninstall unless retention is legally required.
• Never resell or share merchant data, and never use it to train models without explicit written consent.
• Honour deletion requests raised through the dashboard within the stated deadline.

Transport

• HTTPS everywhere; TLS 1.2 minimum.
• Exact-match redirect URIs, PKCE for every authorization.
• Verify webhook signatures with a constant-time comparison.

Operational

• Alert on 401/403/429 spikes and webhook failures.
• Keep an incident contact reachable; we use the support email on the listing.
• Report a suspected breach affecting merchant data within 24 hours.

Violations lead to the app being unpublished and, in serious cases, the organization being suspended.