OrderGate by Gezici Labs
Security & Incident Response
Last updated 9 August 2026
OrderGate is a small app run by a small team, and its security posture is built around that fact: the safest data is the data we never hold. This page states what we actually do, not what we aspire to.
Minimising what is at risk
- Buyer emails and addresses are evaluated inside Shopify’s sandboxed function runtime, which has no network access. They are never transmitted to our infrastructure, so a compromise of our systems cannot expose them.
- Blocking rules stay in the merchant’s own Shopify metafields rather than in our database.
- What we do store is one store credential plus anonymous daily counts. There is no buyer personal data at rest anywhere in our systems.
- We request only the four Shopify permissions the features need, and each one is justified in our App Store listing.
Infrastructure
- The app runs on Cloudflare Workers with a Cloudflare D1 database. Traffic is TLS-only; stored data is encrypted at rest by the platform.
- Every request from Shopify is verified before it is served: embedded admin requests through Shopify’s session token flow, and webhooks through HMAC signature validation. Unsigned or mis-signed requests are rejected.
- The public endpoint that receives checkout events accepts nothing but an opaque token and one of three fixed event names, and is rate limited per token. Anything else is discarded without a response that would confirm whether a token is valid.
- Database access uses parameterised statements exclusively.
Credentials and access
- Secrets — the Shopify API secret above all — live in Cloudflare’s encrypted secret store. They are never committed to source control and never written to logs.
- Shopify access tokens are short-lived and refreshed automatically; they are deleted when a merchant uninstalls.
- Administrative accounts (Shopify Partners, Cloudflare, source control) require multi-factor authentication. Access is limited to people who need it to operate the app.
Development practice
- Changes ship from a version-controlled repository with an automated test suite covering the rule engine, the checkout validation function, and every database operation.
- Dependencies are kept current, and security advisories affecting them are treated as priority work rather than routine maintenance.
If something goes wrong
Our commitment, in order:
- Contain first. On confirming an incident we revoke affected credentials and cut off the exposure before investigating further.
- Establish the facts. We determine what was accessed, whose data was involved, and over what period, before we communicate — but we do not delay notification to finish the investigation.
- Notify within 72 hours. Affected merchants are emailed within 72 hours of us becoming aware of a breach involving their data, and Shopify is notified in parallel. The notice states what happened, which data was involved, what we have done, and what the merchant should do.
- Follow up in writing. Once the investigation closes we publish what caused it and what changed so it cannot recur.
If a breach involves personal data for which a merchant is the controller, we will supply the information they need to meet their own regulatory deadlines, including the 72-hour notification required under GDPR Article 33.
Reporting a vulnerability
Email support@ordergate.app with “security” in the subject line. We acknowledge reports within two business days and will keep you updated until the issue is resolved. We will not pursue legal action against anyone who reports a genuine vulnerability in good faith, avoids accessing or modifying data that is not theirs, and gives us reasonable time to fix it before disclosing.