Security at Sellers.lk

• HTTPS / TLS encryption: all traffic between you and the platform is encrypted in transit.
• Secure authentication: email-verified accounts, hashed passwords, optional two-factor authentication, rate limiting, bot protection and lockouts against guessing.
• Security headers: an enforced Content-Security-Policy, HSTS, clickjacking protection and related browser hardening headers.
• Secure cloud infrastructure: managed, encrypted-at-rest database and file storage with row-level security and least-privilege access.
• Hosted card checkout: card details are entered with our payment provider and never reach the store or our servers.
• Vulnerability scanning and dependency monitoring: automated code scanning and dependency update monitoring run on our API, and we audit dependencies for known issues.
• Webhook and API protection: every request is validated, every store route checks the caller’s permission in that store, and payment and courier callbacks are verified.
• OWASP practices: we build and review against OWASP guidance.

• OWASP Application Security Verification Standard (ASVS) 4.0.3
• OWASP API Security Top 10 (2023)
• TLS best practices

We design, build and regularly review the platform against these standards, including authentication, sessions, access control, input validation, cryptography, logging and API security.

• Application and API review: reviewed against OWASP ASVS and the OWASP API Security Top 10, covering authentication, access control, validation, cryptography, logging and API security.
• Mozilla HTTP Observatory: A+ (110/100, 12 of 12 tests passed).
• Security Headers (Snyk): A+, with Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy all in place.
• Qualys SSL Labs SSL Server Test: A or better on every server, with TLS 1.3 supported.

If you believe you have found a security issue in Sellers.lk, please email security@sellers.lk. Please include:

• a description of the issue and its potential impact,
• the steps or proof of concept needed to reproduce it, and
• the affected URL or feature.

We ask that you:

• give us reasonable time to fix the issue before disclosing it publicly,
• do not access, change or delete other people’s data, and avoid disrupting the service, and
• do not run denial-of-service, spam or social-engineering attacks.

We will acknowledge your report, keep you updated, and credit you if you wish. Our machine-readable contact details are at /.well-known/security.txt.