Security

Minimal access, by design

The app requests exactly one Shopify permission, read_content, covering your blogs and articles, and nothing else. It never requests access to customers, orders, payment information, or any other part of your store. There is no broader permission sitting unused "just in case."

Verified requests, end to end

• Storefront requests (the search box and click analytics) arrive through Shopify's own app proxy, which cryptographically signs every request so the app can confirm which store it genuinely came from before reading or writing anything, and every value in that request is validated against the store's own configuration regardless.
• Webhook deliveries, including the mandatory privacy webhooks described in the Privacy policy, are verified against Shopify's signature before being processed. A delivery that fails verification is rejected outright.
• Every connection between your storefront, the app, and Shopify is made over an encrypted HTTPS connection.

No protected customer data

The app does not request, and does not hold, any of Shopify's protected customer data categories. Combined with the single read-only content scope above, there is no customer or order data in our systems to secure in the first place.

Infrastructure

The app runs on Vercel, with its database hosted by Supabase, both within the European Union. Neither provider exposes the database directly to the public internet. All access goes through the application itself.

Reporting a vulnerability

If you believe you've found a security issue with the app, please report it responsibly through the contact form, selecting "Security report" and including enough detail to reproduce the issue. Please don't access, modify, or attempt to exfiltrate another merchant's data while investigating; report what you've found instead, and we'll follow up promptly.