Security

Read-only by design

The app requests read access for themes, products, inventory, and discounts. It does not request write access and cannot modify those resources. It does not request customer or order scopes. The optional read_audit_events permission is requested only when an eligible Plus merchant enables enhanced audit monitoring.

Minimized monitoring records

Raw Shopify webhook payloads are normalized into the fields required for detection. Published-theme files are inspected as needed, while stored baselines contain checksums, metadata, and extracted indicators rather than a general copy of theme source. Plus audit query text and variables are discarded; network addresses and user agents become keyed fingerprints used for anomaly comparison.

Authenticated delivery and tenant isolation

Shopify HTTPS webhooks are authenticated before processing. The Plus audit transport accepts Google-authenticated Pub/Sub delivery only from the configured subscription and routes events using an enrolled Shopify store domain. Every observation, finding, incident, and alert belongs to a specific store record.

Infrastructure

The production application runs on Cloudflare Workers with Cloudflare D1 and Queues. Secrets are configured outside source control. Background detection and notification work is retried through queues, and production health and structured error signals are monitored.

Responsible disclosure

Send suspected vulnerabilities to security@kittencuddles.app. Include a clear description, reproduction steps, and impact. Do not include merchant secrets, customer information, or payment-card data. Please allow reasonable time to investigate before public disclosure.

Scope and limitations

KittenCuddles detects supported signals and cannot guarantee prevention or detection of every incident. Store owners should retain secure staff access, multifactor authentication, backups, tested alert delivery, and an incident-response process.