Tamper-evident audit chain
Security- and compliance-relevant events are written to an append-only, hash-linked Postgres table. Every row carries the sha256 of the previous row, and database safeguards refuse mutation. The read-only CLI verifier can be run manually; no audit-chain verifier cron is registered. This is evidence scaffolding for qualified review, not a certification claim.
Evidencesrc/libs/AuditChain.ts + migration 0016-audit-chain
RGPD compliance
Users can request a full data export (gzipped JSON of every row tied to their account, signed download link, 24h TTL) and can schedule deletion with a 30-day grace window. The cancel flow uses a single-use token emailed to the user. FK cascades clean every product table on hard delete.
Evidencesrc/actions/account.ts + data_exports table
HTTP hardening
Production routes ship with Content-Security-Policy (default-src 'self', frame-ancestors 'none'), HSTS (max-age 2 years, preload), X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, and a Permissions-Policy that locks down camera, microphone, and geolocation.
Evidencenext.config.ts headers() + /.well-known/security.txt
Idempotent webhooks
The tested Idempotency.handle() middleware implements the Idempotency-Key replay contract, but no live route calls it today. The Stripe webhook separately deduplicates Stripe event IDs in the same table; that hand-rolled path is not a caller of the middleware.
Evidencesrc/libs/Idempotency.ts + migration 0019-idempotency
Secrets handling
Every API key, database password, and HMAC secret is loaded from the environment via a strongly-typed Env module. No secret is shipped to the client bundle — server-only modules are statically analyzed. Local development uses .env.local; production reads from the platform's secret store.
Evidencesrc/libs/Env.ts (zod-validated, server-only)
Responsible disclosure
A verified private vulnerability-reporting contact has not yet been published. Do not send sensitive vulnerability details through unverified channels.
Evidence/.well-known/security.txt