Security is a critical part of any web-based business because online apps can be exposed or compromised in many different ways. Ensure your app is secure before submission to protect merchants from potential risks. This page lists the requirements checked during review; for implementation guidance, see security best practices.

Security

1. Your app must not collect Shoplazza user credentials. As explained in Shoplazza API Authentication, public apps must use OAuth.

2. If your app stores its own credentials, then it must only store salted password hashes instead of actual passwords. How to comply: generate and verify tokens securely.

3. Your app must be protected against common web security vulnerabilities. How to comply: protect against common web vulnerabilities.

4. The app must be served over HTTPS using a valid TLS certificate. How to comply: encrypt traffic with TLS.

5. Your app must not expose network services unnecessarily. How to comply: don't expose unnecessary network services.

6. Your app must not expose its shared secret. How to comply: verify webhook signatures.

7. Your app must generate secure tokens, including expirations and search indexing protections, where applicable. How to comply: generate and verify tokens securely.

8. Your app must not process payments or orders outside of Shoplazza's checkout.

9. Your app must not alter or modify Shoplazza's checkout.