As of August 19, 2026. Report suspected security issues involving B2B Marshal to support@fiveacrecode.com with subject prefix [SECURITY].
Scope
In scope: B2B Marshal systems operated by Five Acre Code, including the embedded app server, private reconciliation worker, database integration, app-owned Shopify configuration and metafields, Shopify Function source/configuration, production credentials, and public B2B Marshal policy/support pages.
Out of scope: merchant-owned Shopify stores, Shopify's platform and checkout, merchant staff accounts, customer devices, third-party apps, independent providers outside Five Acre Code control, social engineering, denial-of-service testing, and issues caused solely by merchant configuration.
Data protected
B2B Marshal protects Shopify authentication/session material; authorized admin identity; shop, company, and location identifiers and facts; order/draft identifiers and financial state; payment-schedule and transaction timing; derived exposure and account metrics; merchant-configured account policy, including tiered discount ladders and markdown settings; app-owned Shopify resource/projection state; audit content; subscription/cache state; privacy/webhook metadata; support messages; and operational logs.
The app deliberately avoids storing customer contact profiles, customer email/phone/address fields, line-item descriptions, full Shopify payloads, card numbers, saved payment credentials, and raw signed webhook bodies.
Security practices
- HTTPS/TLS for public website, app, Shopify, database, and provider traffic.
- Shopify OAuth, embedded-app authentication, authenticated server routes, and separate online/offline session use.
- AES-256-GCM encryption for Shopify access and refresh tokens at rest, with rotation-aware keys kept outside source control.
- Production secrets stored in deployment configuration rather than source code; development and production app/data boundaries are separate.
- Shopify webhook HMAC verification from the raw request, expected-topic checks, delivery-ID deduplication, bounded request work, and retry-safe durable processing.
- No raw webhook payload or authorization/session query logging; structured logs use request IDs and scrub sensitive values.
- Protected customer-data minimization: order/account fields are selected for exposure and reconciliation, while customer contact fields and line items are omitted.
- App-owned company, location, and product metafields contain compact checkout decision inputs rather than copied customer or order profiles.
- Checkout Functions run inside Shopify, make no network requests, and require an explicit active tracked projection before applying B2B Marshal controls. Cart-line identifiers, quantities, and current/compare-at unit amounts used for validation or discount decisions are processed inside that runtime and are not copied into B2B Marshal's database as checkout profiles.
- Durable, fenced, resumable reconciliation jobs and idempotent projection writes so missed or duplicated events do not silently become the only source of truth.
- Bounded retention for completed webhook deliveries, expired online sessions, and resolved reconciliation runs; deliberate retention of financial ledger and audit history while the shop remains installed; and shop-redaction deletion for per-shop application records.
- Persisted checkout-resource identity and health checks with merchant-visible repair paths instead of broad title matching.
- Dependency, build, test, migration, and security review as part of release preparation.
Merchant responsibilities
Merchants remain responsible for Shopify account security, multi-factor authentication, staff and collaborator permissions, installed apps, B2B/customer administration, accurate company/order/terms data, policy review, checkout testing, legal/privacy notices, authoritative financial records, and incident response for systems they control.
Do not place passwords, API keys, access tokens, session cookies, card data, or unnecessary personal data in B2B Marshal messages, notes, hold reasons, audit content, screenshots, or support requests.
Vulnerability reporting
Include the affected shop domain, app URL or route, reproduction steps, impact, request/correlation ID if available, and whether you believe data was accessed or changed. Redact customer and financial details unless support specifically requests a secure follow-up. Do not access another merchant's data, disrupt production, run destructive tests, or publicly disclose an unresolved issue.
We do not currently offer a public bug bounty or authorize testing outside the scope above.
Response
Five Acre Code triages credible reports, contains affected systems, rotates credentials where appropriate, reviews app/provider evidence, patches or rolls back, coordinates with Shopify or other providers, notifies affected parties when required, and performs post-incident review for significant events.
| Severity | Examples | Triage target |
|---|---|---|
| Critical | Confirmed active compromise, public production credential, or confirmed external exposure of merchant/protected data | Under 1 hour |
| High | Credible unauthorized access, contained secret exposure, or a production defect affecting protected financial/account data | Under 4 hours |
| Medium | Non-exploited vulnerability, suspicious activity under investigation, or relevant production dependency advisory | Under 24 hours |
| Low | Hardening issue or informational report | Under 5 business days |
Targets are not guaranteed resolution times. Notification timing depends on confirmation, affected data, applicable law, Shopify requirements, provider coordination, and merchant impact.