Security Disclosure

Security Contact

Security at Shoppex is led by Florian Marzahl, Managing Director of Aura UG (haftungsbeschränkt), the company that operates Shoppex. Reports go to him directly.

Email: [email protected]
Machine-readable contact: /.well-known/security.txt

How to Report

Send one email per issue with "Security" in the subject. Write in English or German. Include:

• The affected URL, endpoint or component.
• The steps to reproduce it, and a proof of concept if you have one.
• What an attacker could do with it, as you understand it.
• The account, shop or request IDs you used for testing.

Do not report a vulnerability through Discord, Telegram, a support ticket or a public channel.

Scope

• shoppex.io, including the merchant dashboard
• dashboard.shoppex.io
• api.shoppex.io, including the Developer API
• docs.shoppex.io
• The Shoppex checkout and the storefront platform on *.myshoppex.io and on custom merchant domains

We care most about issues that let one merchant reach another merchant's data, take over an account, change payments or payouts, or get goods without paying.

Out of Scope

• Content that a merchant puts into their own store. Report that on the Report Abuse page.
• Services of our payment and infrastructure providers, such as Stripe or PayPal. Report those to the provider.
• Denial of service, load testing, spam and social engineering of our staff, merchants or buyers.
• Reports from automated scanners without a working proof of impact, and missing best-practice headers without an attack that uses them.

Testing Rules

• Test only against accounts and shops that you own. Create a free account for this.
• If you reach data that is not yours, stop, do not keep or share it, and tell us what you saw.
• Do not degrade the service for other users, and do not make real payments with cards or accounts that are not yours.
• Keep the details private until we have released a fix, or for 90 days after your report if we have not.

Safe Harbor

If you follow these rules and act in good faith, we treat your research as authorized. We will not take legal action against you or ask a law enforcement agency to do so. If a third party starts legal action against you for research that followed these rules, we will make it known that your work was authorized.

After You Report

• We confirm that we received your report within 3 business days.
• We tell you whether we can reproduce it, and how severe we rate it, within 10 business days.
• We tell you when the fix is live, and we agree with you when the details can be published.

Rewards

Shoppex does not run a paid bug bounty. We still read and answer every report.