Trust & Safety
Security
Protect credentials, seller data, customer information and marketplace workflows.
Credential security
- Use HTTPS for every API request.
- Store live keys in environment variables or a dedicated secrets manager.
- Never commit keys to Git, place them in browser code or include them in screenshots.
- Rotate credentials immediately after suspected exposure.
- Give each integration only the access it needs.
Application security
- Validate types, formats, identifiers and allowed values.
- Use parameterized database queries.
- Apply authorization checks independently of client-supplied identifiers.
- Escape output according to its HTML, JSON, URL or SQL context.
- Keep dependencies and server software updated.
- Log security events without recording secrets or unnecessary personal data.
Payment and personal data
- Do not collect raw payment-card data through undocumented endpoints.
- Minimize customer information stored by integrations.
- Restrict access to order and delivery data.
- Define retention and deletion procedures appropriate to the integration.