ShipGreenLit security posture
We hold ShipGreenLit to the same standard we ask of every customer. This page documents how the platform is hardened, how secrets are managed, and how we verify our own posture continuously.
Signing key & attestation secret
Every attestation token is HMAC-signed with ATTESTATION_SECRET. This secret is provisioned as a Vercel Production and Preview environment variable — never in the Development scope — so signatures issued in production are durable and verifiable across all deployments.
Rotating the key invalidates all in-flight tokens immediately. Key rotation is documented as a zero-downtime operation: provision the new secret, redeploy, revoke the old one.
Content Security Policy & HTTP headers
ShipGreenLit enforces its own security headers on every response: strict-transport-security (HSTS, max-age 2 years, preload), X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin.
The CSP allowlists only the domains required for Stripe embedded checkout (js.stripe.com, checkout.stripe.com) and blocks all others. Permissions-Policy explicitly disables camera, microphone, and geolocation.
Database & data isolation
All persistent data lives in Neon Postgres. Every query is parameterized — no string interpolation. User data is scoped by userId on every query; there is no shared row access between accounts.
The audit log is append-only and hash-chained: each entry stores the SHA-256 of the previous entry's hash, making silent deletion or reordering detectable. Integrity is verified on every read.
Deployment posture
Production deployments are triggered via Vercel's GitHub integration or the Vercel CLI with a scoped deploy token. Environment variables are never committed to the repository — all secrets are provisioned via Vercel's encrypted environment variable system.
ShipGreenLit monitors its own production deployment daily using its own scanning engine. The verification meta tag is present in the <head> of every page. Any regression in our own security headers triggers the same alert pipeline we provide to customers.
Questions or concerns? Reach us at security@shipgreenlit.com. We respond to security disclosures within 24 hours.