Security

Reporting a problem

If you believe you have found a security problem in Nepzio, please tell us privately, with enough detail to reproduce it, and give us time to fix it before telling anyone else. Contact us by phone or WhatsApp on +977 974-769-1614 and we will arrange a private channel.

Please don't access or change data that isn't yours, run tests that could disrupt stores, or use automated scanners against stores' sites.

How the API protects stores

• Secret keys: only a fingerprint is stored; each key is shown once. Every request needs a key, and each key can do only what its scopes allow, for its one store.
• Server only: requests carrying a key from a browser are refused.
• Encrypted: webhook signing secrets are encrypted at rest.
• Webhooks:
  • signed;
  • sent only over HTTPS;
  • never to private or local network addresses;
  • redirects aren't followed.
• Visible to owners:
  • every key's use (last used, from where, how many requests);
  • every order and customer read through the API, on Settings → Data exports.