QueueFront security disclosure

Effective date: 2026-10-08

QueueFront protects Shopify checkout with fail-closed validation, authoritative admission, tenant isolation, encrypted credentials, and bounded proofs. This page summarizes the implemented release controls; it is not a certification or a claim that every threat is eliminated.

Current controls

• Shopify-authenticated embedded administration and HMAC-authenticated webhooks;
• minimized Shopify scopes and a protected-data request limited to the required customer/order identifiers and order-line evidence;
• no Shopify customer Name, Email, Phone, Address, or tag ingestion in the release checkout path; direct consent-based Waiting List email/SMS contacts are a separate processing path described in the Privacy Policy;
• encrypted OAuth/session credentials, signing keys, internal secrets, customer-data reports, and off-host database backups;
• a dedicated encrypted volume for the production database, transaction logs and retained migration recovery files;
• separate local, staging, Beta, and production credentials and data;
• tenant-scoped control-plane access and deterministic event/queue ownership;
• per-event Ed25519 admission tokens with bounded validity and replay evidence;
• fail-closed inventory, capacity, position, ETA, and checkout behavior;
• Admission Continuity Mode and documented emergency bypass for safe recovery;
• loopback-only PostgreSQL with separate owner, migrator, and runtime roles;
• runtime read-only access to retention approvals/maintenance holds, with separately restricted cleanup operators; daily analytics, five email/SMS categories, expired privacy-report and opted-out SMS contact cleanup are enabled only for the two retained test stores, with bounded batches, maintenance holds and expiring reviews;
• audit, health, backup and restore evidence, with bounded process-log rotation and category-specific retention controls; and
• explicit deprovisioning and rollback runbooks.

QueueFront does not currently claim SOC 2, ISO 27001, PCI DSS certification, HIPAA suitability, uninterrupted availability, perfect bot prevention, or a public bug-bounty program.

Report a vulnerability

Email [email protected]. Do not send secrets or customer data. This is QueueFront’s monitored security reporting channel. Include a concise description, affected surface, reproducible steps using your own test tenant/data, impact, and a safe contact method.

Good-faith research must:

• use only accounts, stores, events, and data the reporter owns or is expressly authorized to test;
• stop before accessing, changing, downloading, or deleting another party’s data;
• avoid denial of service, high-volume automation, phishing, social engineering, persistence, malware, and secret extraction;
• avoid disrupting active events, checkout, Shopify, Cloudflare, RunCloud, shared infrastructure, or merchants; and
• allow reasonable time for investigation before public disclosure.

AtlasFlare LLC will acknowledge verified reports through the monitored channel, investigate proportionately, coordinate remediation and disclosure, and not seek action against good-faith research that follows these rules. This statement does not authorize unlawful conduct or bind third parties.

Security incidents

Suspected customer-data exposure, forged admission, cross-tenant access, checkout bypass, signing-key compromise, or destructive infrastructure access activates QueueFront’s incident-response policy. The initial priorities are to protect checkout and customer data, stop unsafe admissions, preserve non-sensitive evidence, rotate affected credentials, notify affected owners, and restore from a tested recovery point.

Merchant responsibilities

Merchants must protect Shopify staff accounts, grant only approved scopes, test on unpublished themes, configure truthful inventory/capacity, keep emergency contacts current, and promptly report suspicious behavior. QueueFront will never ask a merchant to place a credential in chat, a support ticket, source control, or a command-line argument.