Skip to content
hidden

Security

What we do to keep your store, your buyers and your money safe

This page lists what is actually built, not what we aspire to. Where a control depends on you (turning on two-factor, verifying webhook signatures) it says so. No system is perfectly secure; if we learn of a breach affecting you we will tell you without undue delay.

Report a vulnerabilityPrivacy policy

  • Accounts

    bcrypt-hashed passwords, two-factor authentication with recovery codes, signed sessions that die with your old password, new-device alerts and a security log.

  • Money

    On-chain payments with no card numbers anywhere. Balances are withdrawn to a wallet you control; large withdrawals get a human look.

  • Files and deliverables

    Private storage, download links signed per order and per item, keys and credentials revealed only after the network confirms.

  • Integrations

    API keys stored as hashes and shown once. Every webhook and dynamic delivery is HMAC-SHA256 signed with a timestamp and replay window.

  • Platform

    Clickjacking protection, rate limits on every public endpoint, SSRF guards on outbound URLs, and an audit trail for sensitive actions.

  • Privacy

    No trackers or ad pixels from Hidden, minimal data, masked buyer emails in public feeds, and clear rules on what sellers may do with buyer data.

Each area is detailed below. Anchors: accounts, money, files, integrations, platform, privacy.

Seller accounts

Passwords are the weakest link on any platform, so the account layer assumes they will leak and limits what a leaked one is worth.

  • Passwords are hashed with bcrypt and never stored or logged in clear. New passwords must pass a strength check and are rejected when they appear on a list of common passwords.
  • Two-factor authentication with any authenticator app (TOTP), plus eight single-use recovery codes shown once. We never disable two-factor from a plain support request.
  • Sessions are signed, server-side expiring cookies that carry a password-version claim: changing or resetting your password signs out every other device at once.
  • Sign-ins from a device or network we have not seen before trigger an email alert with the device, IP address and time.
  • A security log records sign-ins, password changes, two-factor changes, email changes, API key creation and withdrawal requests. Sensitive store actions are written to a per-store audit log attributed to the team member who performed them.
  • Email verification uses 6-digit codes and single-use links that expire in 30 minutes; password reset links work once and expire in 30 minutes. Neither reveals whether an address has an account.
  • Sign-in, registration, reset and verification endpoints are rate-limited per address and per account, so guessing a password or a code is slow enough to notice.
  • Account deletion has a 14-day cooldown with an emailed cancel link, so a hijacked session cannot erase a store in one click.

Payments and payouts

Hidden never sees a card number because there are none. Payments settle on-chain; what we hold is a USD-denominated balance you can withdraw at will.

  • Buyers pay a crypto invoice; the order unlocks when the network confirms. Payment notifications are verified with an HMAC signature before any order is marked paid, and every order records the amount actually received.
  • Underpaid orders are never delivered automatically: the seller decides within 48 hours. Oversold orders (stock ran out between checkout and payment) are flagged for a refund instead of silently failing.
  • Your balance is credited per confirmed order with the platform fee snapshotted at checkout. Withdrawals go to the USDT (BEP20) address you saved; small withdrawals are sent automatically, larger ones get a manual review, and the transaction hash is shown in your wallet history.
  • Withdrawals require a signed-in seller session and are recorded in the security log. During an abuse investigation withdrawals on the affected store can be frozen; the seller is told why.
  • Seller funds are never lent, invested or used for anything else. Hidden is not an escrow service and does not custody your private keys.
  • Platform-wide switches let us pause withdrawals or new sign-ups during an incident, with a status message on this site and at checkout.

Files, keys and deliverables

Whatever a seller uploads is treated as a paid secret from the moment it is stored.

  • Product files and images live in a private object store, never on a public URL. Downloads go through a signed link tied to one order item that expires after seven days and is refreshed from the order page.
  • Serial keys, credentials and private links are locked until the order is paid; each key is claimed exactly once by one order and never reissued.
  • Order pages reveal deliverables to whoever holds the link, so receipts tell buyers to keep the link private and the lookup flow needs both the email and the order id.
  • Storefront buyer accounts use one-time codes sent by email, never passwords, with a per-store session cookie.
  • Deleting a store or an account removes its files from storage; records we must keep for disputes or by law are kept only as long as required.

API keys, webhooks and dynamic delivery

Anything that leaves Hidden is signed, and anything that reaches Hidden from your servers is authenticated.

  • API keys start with sk_live_, are scoped to one store, and are shown exactly once: we keep a SHA-256 hash plus a short prefix. Revoking a key keeps it listed for the audit trail. Up to ten keys can be active per store.
  • Every webhook delivery carries X-Hidden-Timestamp and X-Hidden-Signature: HMAC-SHA256 of the timestamp, a dot and the raw body, using a per-endpoint secret you can rotate. Reject anything older than five minutes and compare in constant time.
  • Failed deliveries are retried with backoff and the same X-Hidden-Delivery id so receivers can de-duplicate; an endpoint that keeps failing is switched off rather than hammered.
  • Dynamic delivery requests are signed the same way. Verify the signature before provisioning anything: anyone who learns your endpoint URL could POST to it.
  • Outbound URLs you configure must be public https hosts. Loopback, private, link-local and internal ranges are refused both by hostname and by what the name resolves to at request time, which blocks server-side request forgery.
  • The public REST API is read-only, CORS-open and cached for a minute at the edge with per-IP limits; buyer emails in public feeds are masked and order ids are never exposed there.
verify-webhook.tsts
import crypto from "node:crypto";

export function verify(secret: string, timestamp: string, signature: string, rawBody: string): boolean {
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false; // 5-minute window
  const expected = crypto.createHmac("sha256", secret).update(`${timestamp}.${rawBody}`).digest("hex");
  const given = signature.replace(/^sha256=/, "");
  return expected.length === given.length && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(given));
}

Platform hardening

The boring layer: the headers, limits and logs that make the rest hold up.

  • Every page refuses to be framed except by Hidden itself (Content-Security-Policy frame-ancestors). Only the embeddable product, checkout and order routes may be framed, and only when requested by the embed script.
  • Public forms (support, abuse reports, tickets, storefront sign-in) are rate-limited per address and carry a honeypot field; abuse reports are stored without the reporter's IP address.
  • Sellers can block checkouts by email, domain, disposable-email provider, IP or CIDR, country, VPN or hosting network, and Discord id; blocked attempts are logged so you can see what fired.
  • Secrets are read from the environment at call time and never at build time; a missing key disables the feature with a clear error instead of failing open.
  • Administrative actions (suspensions, refunds, withdrawal approvals, setting changes) are written to an audit log with the acting admin.
  • Traffic is encrypted in transit and the database and object store are encrypted at rest by our hosting providers.

Privacy by construction

Collecting less is the most reliable control we have.

  • No tracking pixels, third-party analytics or ad networks from Hidden on storefronts, checkout or this site. Anything a seller enables on their own store is disclosed on that store.
  • Storefront visit counts use a daily hash of IP, user agent and a server secret; no cookies are set and the hash cannot be reversed.
  • Buyers check out with an email address only. Sellers see what fulfilment needs and are bound by the terms in how they use it.
  • You can export your orders and customers on request and delete your store or account yourself.

Your side

Five minutes that matter most

Most account takeovers we see would have been stopped by the first two items.

  1. 1

    Turn on two-factor authentication

    Account, Security. Save the recovery codes somewhere that is not your inbox.

  2. 2

    Use a long, unique password

    A passphrase of three or four unrelated words beats a short string of symbols. Never reuse it.

  3. 3

    Verify webhook signatures

    Copy the snippet above. Treat an unsigned request as an attack, not a bug.

  4. 4

    Double-check your payout address

    Withdrawals sent to the address you saved cannot be recalled.

  5. 5

    Keep API keys on the server

    Never ship an sk_live_ key in a browser bundle or a mobile app. Rotate it if it leaks.

  6. 6

    Review the security log

    New device you do not recognise? Change your password, which signs everything else out.

Responsible disclosure

Found a vulnerability?

How to report

Email support@sellhidden.com with "Security" in the subject. Include the affected URL or endpoint, steps to reproduce, and what you were able to access. We acknowledge every report, keep you informed while we fix it, and credit you if you want.

We do not currently run a paid bug bounty. We say so here rather than let you find out after the fact.

Please

  • Test only against accounts and stores you own; a free store is enough for almost everything.
  • Do not access, modify or download other people's data, and stop as soon as you have proof.
  • Give us reasonable time to fix before publishing.
  • Do not run denial-of-service, spam or social-engineering tests against people or the support inbox.

Something about a store rather than the platform? Report a listing.