Security

Last updated: 18 May 2026

Stori treats security as a first-class engineering concern. This page describes how to report a vulnerability, what is in scope, and the controls we have in place today.

Reporting a vulnerability

If you believe you have found a security issue affecting Stori, please email security@onestori.com. A PGP key for encrypted disclosure is available on request.

Please include:

  • A clear description of the issue and its impact
  • Steps to reproduce, with sample requests or payloads
  • Any proof-of-concept code or screenshots
  • Your name and how you’d like to be credited (optional)

Our commitments

  • We will acknowledge your report within 2 business days.
  • We will provide an initial triage and severity assessment within 5 business days.
  • We will keep you informed as we investigate and remediate.
  • We will publicly credit you (with permission) once the issue is resolved.
  • We will not pursue legal action against researchers acting in good faith under this policy.

Scope

The following systems are in scope:

  • onestori.com and all subdomains
  • The Stori Candidate App and Client ATS
  • The Stori Chrome extension
  • Public API endpoints under /api/public/*
  • Outbound webhook signing and delivery

Out of scope

  • Findings from automated tools that have not been manually verified
  • Denial-of-service attacks, volumetric testing, or rate-limit stress tests
  • Social engineering of Stori staff, customers, or vendors
  • Physical attacks against Stori facilities or staff
  • Reports of missing security headers without a demonstrated exploit
  • Vulnerabilities in third-party software that Stori does not control (Supabase, Stripe, Mux, Vercel, etc.) — please report those to the vendor directly
  • Issues affecting only end-of-life browsers

Current controls

  • Authentication: Supabase Auth with PKCE, httpOnly cookies, OAuth CSRF state validation on all flows.
  • Authorization: Postgres row-level security on tenant-scoped tables. Every API route checks authentication and applies a rate limit.
  • Input validation: Zod schemas on every request body. HTML sanitization via DOMPurify. File uploads validated by magic bytes and size limits.
  • Transport: HTTPS enforced via HSTS (max-age=31536000; includeSubDomains). Strict Content-Security-Policy in enforcing mode. COOP, CORP, X-Frame, Referrer-Policy, and Permissions-Policy set.
  • Rate limiting: Sliding-window limiter backed by Upstash Redis with per-endpoint tiers.
  • Webhooks: Outbound deliveries are HMAC-SHA256 signed with a 5-minute timestamp tolerance and timing-safe comparison. Inbound webhooks (Stripe, Mux, Resend) are signature-verified and fail-closed.
  • Secrets: Managed via Vercel environment variables; never committed to the repository.
  • Observability: Sentry for error tracking with source maps stripped from production builds. Structured application logging. Hourly synthetic monitoring of production flows.
  • Backups: Supabase managed point-in-time recovery with daily snapshots.
  • Dependencies: Dependabot for npm and GitHub Actions. Security advisories are reviewed weekly.
  • Audit logging: Sensitive operations (admin actions, credit changes, contact unlocks, account exports and deletions) are recorded to an immutable audit log.

Data subject rights

Stori users can export all of their data via GET /api/account/export and permanently delete their account via POST /api/account/delete. See our Privacy Policy for details on what we collect, how we use it, and how to exercise your rights under GDPR and CCPA.

Contact

Security: security@onestori.com
General: hi@onestori.com