Join the private beta

Security

Test commerce,
closed production boundary.

This staging service can create test checkouts and test entitlements. It deliberately cannot accept a live event, create a real charge, or issue a production grant.

01

Isolation

PostgreSQL and Next.js remain private to the internal container network; Caddy is the only public web entry.

02

Test Mode lock

Startup refuses production application mode, live billing mode, incomplete resource IDs, or a signing key that does not match the pinned wm1 test public key.

03

Signed events

Lemon Squeezy webhooks are authenticated over the exact raw body with HMAC-SHA256 before JSON parsing, then stored and processed idempotently.

04

Bounded grants

One-time codes are hashed, device activation is serialized in PostgreSQL, and no Pro entitlement can exceed two active installation records.

05

Key custody

The Ed25519 test private key stays outside Git and build context, mounted read-only into the non-root web container only.

06

Safe diagnostics

Structured logs omit bodies and recursively redact signatures, tokens, activation credentials, cookies, payment fields, and database secrets.

Current boundary

What remains private or absent.

  • PostgreSQL 5432 and Next.js 3000 have no host publication.
  • The Docker socket and Caddy administration endpoint are unavailable.
  • No payment-card data or raw webhook body is stored.
  • No API or webhook secret is shipped to browser or desktop code.
  • No key ID, feature claim, codec claim, or renderer claim exists in wm1.
  • No live product, charge, entitlement, release, or launch is enabled.

Responsible reports

Do not send sensitive evidence initially.

Use the support address shown on the Support page for a suspected issue. Do not include credentials, private keys, activation tokens, mirrored media, or raw payment-provider payloads in the first report.