Security Policy

Our Commitment

Tree of Africa™ takes the security of our website and your data seriously. This page explains the safeguards we have in place and how to report a security vulnerability if you find one.

Security Measures in Place

• HTTPS (TLS encryption) enforced on all traffic to and from the site.
• Account lockout after repeated failed admin login attempts (3 attempts / 60-minute lockout).
• Per-route authorization checks on every admin API endpoint — no endpoint trusts the client.
• Rate limiting on login, checkout, contact, newsletter, and review-submission endpoints to block abuse.
• Row-Level Security (RLS) enabled on every publicly-writable database table.
• Admin passwords are bcrypt-hashed; sessions use signed JWT tokens, never stored in plain text.
• Automated dependency scanning (Dependabot) with scheduled update pull requests.
• Continuous integration build verification on every code change before it can reach the live site.
• Branch protection on our source repository: force-pushes and history rewrites are blocked, and a passing build check is required before any change can be merged — with no exceptions, including for administrators.
• Payment processing is handled exclusively by Stripe (PCI DSS Level 1 certified) — we never see or store your full card number, CVV, or banking details.

Scope

This policy covers:

• The public storefront and checkout/payment flow
• The admin portal and its API routes
• Authentication, session, and rate-limiting logic
• Database access patterns and row-level security policies

Out of scope: vulnerabilities in third-party services we depend on (Stripe, Supabase, Printful, Resend, Netlify) — please report those directly to the respective vendor.

Reporting a Vulnerability

If you believe you’ve found a security vulnerability affecting this site, please do not disclose it publicly. Instead, report it privately by emailing us with:

• A description of the vulnerability and its potential impact
• Steps to reproduce it (proof-of-concept code or requests, if applicable)
• The affected area of the site (e.g., checkout, account login, a specific page)
• Any suggested remediation, if you have one

What to Expect

• We aim to acknowledge new reports within 5 business days.
• We will keep you updated on remediation progress and confirm once a fix has been deployed.
• We ask that you give us reasonable time to address the issue before any public disclosure.
• Credit will be given if you’d like it (or omitted on request).