Security Incident Response Policy
Last updated: 2026-10-01
This policy sets out how Webite d.o.o. (Ljubljana, Slovenia), the operator of SecureBite API Proxy, detects, handles and reports security incidents. A security incident is any event that compromises, or may have compromised, the confidentiality, integrity or availability of data the app holds or processes.
Report an incident or vulnerability: email
support@webite.rocks with "SECURITY" in the subject. We acknowledge reports within one business day.
1. Scope
- Merchant credentials: Shopify access and refresh tokens, and the secret headers and query params stored in merchants' proxy routes.
- Customer data: logged-in customer emails, read from Shopify only for routes that use them and held in memory for up to 5 minutes; customer IDs present in proxy requests.
- App secrets and infrastructure: the Shopify API secret, email provider key, and the Cloudflare, Shopify Partners and GitHub accounts used to run the app.
2. Severity
| Level | Examples | Start response |
|---|
| Critical | Customer data or merchant credentials exposed; app secret or operator account compromised | Immediately, within 4 hours |
| High | Exploitable vulnerability with no evidence of use; a security control not working | Within 24 hours |
| Low | Hardening issue with no realistic path to data | Next planned release |
3. Response steps
- Detect and record. Incidents come from reports, Cloudflare Worker logs, Shopify notices or our own review. Each one is logged with time of discovery, what is affected and every action taken.
- Contain. Stop the exposure first: roll back the Worker to the last good version, disable affected routes or features, and revoke exposed credentials.
- Assess. Establish what data, which shops and which time window are affected, using Worker logs and stored configuration.
- Notify (see section 4).
- Recover. Ship the fix, rotate every credential that may have been exposed, and confirm normal operation.
- Review. Within 14 days, write a short review of the cause and the changes made to prevent a repeat, and update this policy if needed.
4. Notification
- Affected merchants: without undue delay and no later than 72 hours after we confirm an incident affecting their data, by email to the store's notification address. We say what happened, what data is involved, what we have done and what the merchant should do (for example, rotate an API key stored in a route).
- Shopify: promptly, through the Shopify Partner support channel, when merchant or customer data from Shopify is involved.
- Supervisory authority: where we act as controller and GDPR requires it, the Information Commissioner of the Republic of Slovenia within 72 hours of becoming aware. Where we act as processor for a merchant, we give the merchant what they need to meet their own obligations.
5. Credential playbooks
- Shopify API secret: rotate it in the Partner Dashboard and update the Worker secret; all App Proxy and webhook signatures then use the new secret.
- Merchant access tokens: delete the stored tokens for affected shops; a fresh token is issued the next time the merchant opens the app.
- Route secrets (third-party API keys): we cannot rotate these ourselves, so we tell each affected merchant which keys to rotate with their provider.
- Operator accounts: revoke sessions and API tokens, reset the password and second factor, and review recent account activity.
6. Prevention
- Access to production systems is limited to the operator, with unique strong passwords and two-factor sign-in.
- All traffic is HTTPS. App Proxy and webhook requests are verified by HMAC signature. Customer emails are never written to storage or logs.
- Data is deleted on uninstall and on Shopify's
shop/redact webhook, as described in the privacy policy.
