Security & Responsible Disclosure

• All traffic served over HTTPS; data encrypted at rest at the storage layer.
• Database row-level security so a seller can only read and write their own store, products and orders.
• Passwords hashed with a modern algorithm; optional TOTP two-factor authentication.
• Session management with the ability to sign out other devices.
• Order totals recalculated server-side so prices cannot be tampered with in the browser.
• Privileged operations verified server-side against a dedicated roles table, never client-side flags.
• Rate limiting on public entry points such as storefronts, order lookups and payment submissions.
• Seller payment details checked for format server-side; payments themselves move directly between customer and seller, so we never hold funds or card data.

• Use a unique password and enable two-factor authentication.
• Never share dashboard access; sign out of shared devices.
• Do not paste card numbers or sensitive documents into product or order notes.
• Double-check the UPI ID you publish; customers pay it directly and we cannot recover a wrong transfer.
• Never ask a customer for their UPI PIN, OTP or card details.

Email support@snapcatalog.app with a description, reproduction steps and impact. We aim to acknowledge within 3 business days and to keep you updated until the issue is resolved.

Please act in good faith: test only against your own account, avoid accessing other people's data, do not run denial-of-service or spam tests, and give us reasonable time to fix an issue before disclosing it. If you follow this, we will not pursue legal action for your research.

If a security incident affects your data we will notify affected users without undue delay, describe what happened and what we are doing, and inform regulators where the law requires it.