Security policy

How to report a vulnerability, what we promise in return, and what happens if something goes wrong.

Last updated 2 August 2026.

Reporting a vulnerability

Write to support@novastack.co with SECURITY in the subject line. That subject is triaged ahead of everything else. Include what you found, how to reproduce it, and what you think an attacker could do with it.

Please do not open a public issue, post it, or tell anyone else until we have had a chance to fix it.

What we promise you

• An acknowledgement within two working days, from a person.
• An assessment and an intended fix date within five working days.
• Credit in the release note, if you want it and the report is valid.
• Safe harbour. We will not pursue or support a legal claim against anyone acting in good faith under this policy: testing only against your own store, not accessing or altering anyone else's data, not degrading the service, and stopping as soon as you have proved the point.

We do not run a paid bug bounty. We say so rather than leave you to find out.

In scope

The Doorman application, its edge worker, and this website. Out of scope: Shopify itself, our hosting provider's infrastructure, findings that only affect an outdated browser, and reports generated by a scanner with nothing behind them.

What we hold, and what we do not

The short version of our exposure, because it is the honest way to describe a security posture:

• We never hold card numbers, bank details or customer passwords. There is no field for them and Shopify does not send them.
• We hold connection data about storefront visitors, and order verdicts. What that is, and when it is deleted, is in the privacy policy.
• All traffic to the app and to the edge is over TLS.
• The app asks Shopify for a fixed, declared set of permissions and no more. They are listed at install and every one of them is tied to a call the app actually makes.
• Credentials live in the deployment environment, never in the source repository.

If there is an incident

An incident is any unauthorised access to, disclosure of, or loss of data we hold for you. If one happens:

• We contain it first, then investigate.
• We notify affected merchants without undue delay, and within 72 hours of becoming aware, at the email on the account.
• The notice says what happened, which data was involved, what we have done, and what we recommend you do. If we do not yet know something, the notice says so instead of waiting for certainty.
• A written follow-up goes out once the cause is established.

As processor we notify you; where you are the controller, notifying your supervisory authority and your customers is yours to do, and we will give you what you need for it.

Responsible operation

Doorman decides whether to serve a page to a person. We treat a wrongful block as a defect, not a footnote: simulation mode ships on every plan, including the free one, so a rule can be judged on real traffic before it turns anyone away.