Security

How this shop is built to keep an order — and the person who placed it — safe.

Payments

Card data never touches this site. Checkout hands off to a PCI DSS Level 1 payment processor, which returns only a payment reference. The shop stores that reference, not a card number.

In transit and at rest

• Every request is served over TLS 1.3; plain HTTP is redirected.
• Order and customer records live in an encrypted-at-rest database inside SOC 2 Type II cloud infrastructure.
• Admin passwords are stored as PBKDF2-SHA256 hashes with 100,000 iterations and a per-account random salt. A stolen database does not yield a usable password.

Access control

• The admin is protected by an opaque session token that expires after 30 days and is revoked on sign-out and on any password change.
• Sign-in is rate limited to five failed attempts per fifteen minutes, counted per account and per network address.
• Every change to a product, order, or setting is written to an append-only audit log with the actor, the action, and the time. Request bodies and secrets are never recorded.

Application

• Every endpoint validates its input against a declared schema and rejects anything malformed with a 400 before it reaches the database.
• Prices, shipping and tax are computed on the server from the catalogue. A modified cart in the browser cannot change what is charged.
• Payment capture and label purchase are idempotent, so a retry or a double-click cannot charge twice or buy postage twice.
• Errors return a request id, never a stack trace. Logs redact email addresses.
• A syntax gate parses every script before a deploy is allowed to proceed.

Reporting a vulnerability

Email security@catulie.com, or see /.well-known/security.txt. We aim to acknowledge within two business days. Please give us a reasonable window to fix an issue before disclosing it, and do not access other people's data while testing. Researchers who report in good faith are credited on the acknowledgements page if they want to be.