Security

POS Cafe runs inside Shopify stores and handles order information for cafes and restaurants, so we take its security seriously. This page explains who is responsible for security at POS Cafe, how we protect merchant data, and how to report a security vulnerability to us.

1. Security contact

1.1 Adam Wooding, Co-Founder, leads security at POS Cafe and is responsible for how we handle vulnerability reports.

1.2 To report a security issue, email security@poscafe.app. Please do not use the support form or social media for security reports.

1.3 Our contact details are also published in machine-readable form at /.well-known/security.txt, following the security.txt standard (RFC 9116).

2. How we protect merchant data

2.1 Payments. POS Cafe never sees or stores card details. Payments are processed by Shopify.

2.2 Store access. POS Cafe connects to a store only through Shopify’s app installation, with the permissions the merchant approves. Uninstalling the app removes our access to the store.

2.3 Encrypted connections. The POS Cafe app and this website are served over encrypted connections (HTTPS).

2.4 Hosting. We do not run our own servers. POS Cafe is hosted with established cloud infrastructure providers.

2.5 Limited access. Only POS Cafe’s core team can access our production systems.

2.6 Development practices. Changes are tested on separate environments before they reach production. We receive automated alerts for known vulnerabilities in the software we depend on, and we review the app against Shopify’s app security requirements.

3. Reporting a vulnerability

3.1 If you believe you have found a security vulnerability in POS Cafe, email security@poscafe.app with:

• (a) a description of the issue and the part of POS Cafe it affects;
• (b) the steps needed to reproduce it, including any URLs, requests or screenshots;
• (c) what an attacker could do with it; and
• (d) how we can contact you for follow-up questions.

3.2 Please include only the minimum information needed to show the issue. Do not send us merchant or customer personal information you came across while testing.

3.3 After you report an issue, we aim to:

• (a) confirm we received your report within 3 business days;
• (b) give you our initial assessment within 10 business days;
• (c) keep you updated while we work on a fix; and
• (d) tell you when the issue has been fixed.

4. Testing guidelines

4.1 When looking for vulnerabilities, please:

• (a) test only against your own Shopify development store, never a real merchant’s store (you can create a free development store from the Shopify Partner Dashboard);
• (b) not access, change or delete data that does not belong to you. If you come across someone else’s data, stop, do not keep a copy, and tell us;
• (c) not run denial-of-service or load tests, send spam, or use social engineering or phishing against our team, merchants or their customers;
• (d) not use automated scanning that sends a high volume of requests or affects the service for merchants; and
• (e) give us a reasonable time to fix the issue before you share any details publicly, and agree a disclosure date with us. We suggest 90 days from your report.

5. Scope

5.1 In scope:

• (a) the POS Cafe app for Shopify, including the app in Shopify admin, the POS Cafe tile and extensions in Shopify POS, and the online ordering block for Shopify themes;
• (b) this website, including the help centre at poscafe.app/docs; and
• (c) our order printing service for receipt printers.

5.2 Out of scope:

• (a) Shopify’s own platform, including Shopify admin, Shopify POS and checkout. Please report those issues to Shopify’s bug bounty program;
• (b) third-party services POS Cafe connects to, such as kitchen display systems, delivery and pickup apps, and printer firmware;
• (c) a merchant’s own storefront theme or other apps installed in their store;
• (d) issues that need physical access to a merchant’s device or printer;
• (e) missing security headers, email settings (SPF, DKIM or DMARC) or software version banners, without a demonstrated security impact; and
• (f) self-XSS, clickjacking on pages with no sensitive actions, and missing rate limits on actions that do not change data.

6. Safe harbour

6.1 We consider security research carried out in good faith and in line with this policy to be authorised. We will not take legal action against you, or ask law enforcement to investigate you, for that research.

6.2 If you are unsure whether something you plan to do is consistent with this policy, email us at security@poscafe.app before you do it.

7. Rewards

7.1 POS Cafe does not run a paid bug bounty program at the moment.

7.2 With your permission, we are happy to thank you publicly for a valid report once the issue has been fixed.