Trust
Security
Toolora is built with security, clean UX, and conversion in mind. This page summarises the controls we enforce before launch and how affiliate tracking and listing payments are handled.
Control checklist
- HTTPS / HSTSok
HSTS sent in production headers; use TLS at the edge on deploy.
- Security headersok
CSP, XFO, nosniff, Referrer-Policy, Permissions-Policy, COOP.
- XSS resistanceok
React escaping + text sanitisation on listing inputs; no dangerouslySetInnerHTML except JSON-LD.
- CSRF on listing formok
Double-submit cookie (SameSite=Strict) on /list.
- Open redirect protectionok
/go only resolves catalogue keys; outbound URL scheme validated.
- Affiliate tracking safetyok
No user-controlled redirect targets; noindex on hops.
- Payment data handlingok
Stripe Checkout for paid tiers; cards never touch Toolora forms.
- Server listing queueok
POST /api/listings with validation + rate limit; admin review via ADMIN_API_KEY.
- Rate limitingok
In-memory limits on listing POSTs and /go affiliate hops (per IP, per instance).
- User preference storageok
localStorage prefs validated against allowlists (locale, categories).
Details
Affiliate hops only resolve keys from our catalogue (/go/[slug]). User-supplied URLs cannot become redirect targets. Destinations are checked for http(s) schemes before redirect.
Listing form sanitises text, validates URLs, enforces category/tier allowlists, uses a SameSite CSRF cookie, and never accepts card data. Paid tiers mark pending_checkout only.
Preferences in localStorage are re-validated against locale and category allowlists on load and save.
JSON-LD is the only intentional dangerouslySetInnerHTML usage; content is serialised from trusted app data with < escaped.
Production monitoring
Uptime probes should hit GET /api/health every 1–5 minutes and alert when status is not ok. Full deploy steps: see the project DEPLOY.md.
Report a vulnerability
If you find a security issue, email the operator privately before public disclosure. Do not test against production with destructive payloads.