Selldone takes the security of its platform, its open-source projects and its merchants' data seriously. This policy applies to every repository in the selldone organization. A repository may add its own SECURITY.md with project-specific details.

Please do not report security vulnerabilities through public GitHub issues, discussions or pull requests.

Email security@selldone.com with:

• The affected repository, package and version (or commit)
• A description of the vulnerability and its impact
• Step-by-step instructions to reproduce it, and a proof of concept if available
• Any suggested fix or mitigation

1. We acknowledge your report within 48 hours.
2. We investigate, confirm the issue and assess its severity and impact.
3. We develop and test a fix or mitigation.
4. We release the fix (a patch release of the npm package, or a server-side fix for the platform).
5. Once resolved, we document the issue and credit you if you wish.

Please give us a reasonable amount of time to fix the issue before any public disclosure.

• Source code in this organization's repositories and the packages published from them (@selldone/* on npm and selldone-cli)
• Selldone platform APIs used by these projects (selldone.com, api.selldone.com, xapi.selldone.com, gapi.selldone.com, capi.selldone.com)

Out of scope: denial-of-service tests, social engineering, physical attacks, and testing against shops you do not own. Only test with your own shop and your own access tokens.

Security fixes are applied to the latest published version of each package. Please keep your dependencies up to date.

• Never commit access tokens, OAuth client secrets or webhook signing keys to a repository.
• Use the narrowest token scopes your integration needs, and revoke unused tokens in the developer panel.
• Validate webhook signatures before trusting incoming data.