Security

Protecting creator integrations

Store and API credentials that creators connect to Escalative are encrypted before storage. Each credential is protected independently so material cannot be casually reused across accounts or fields. Master encryption material is kept in protected server configuration and is not stored alongside marketplace data.

Public profile APIs never return live secrets. Credentials are unlocked only on the server when an authorized operation needs them, such as checkout, purchase verification, analytics, or webhook processing.

Account and session protection

• Passwords are stored using a modern one-way password hashing scheme with unique salts.
• Sessions use high-entropy identifiers and expire automatically.
• Sensitive cookies are marked HttpOnly and use secure transport in production.
• Role checks gate creator, owner, and administrator actions.
• Authentication and recovery endpoints are rate-limited to slow credential stuffing and OTP guessing.

Purchase and identity integrity

Purchase claiming and review eligibility require a verified buyer identity match for the connected Cfx.re account. Manual or mismatched transaction imports are rejected. Checkout intents and webhook deliveries are validated before library updates are applied.

Platform hardening

• HTTPS is required in production with long-lived transport security headers.
• Clickjacking protections, content-type sniffing protections, and a restrictive content security policy are enabled.
• Common probe paths and automated scanning targets are blocked.
• API responses for sensitive routes are not cached by shared intermediaries.
• Production builds do not expose browser source maps.
• Service error responses avoid leaking internal system details to clients.

What creators and buyers should do

• Use unique, strong passwords and enable multi-factor authentication on Escalative-related accounts where available (email, Discord, Tebex, hosting).
• Connect only the minimum Tebex permissions required for your store.
• Never share API keys, webhook secrets, OTP codes, or session cookies in chat, tickets, screenshots, or public repositories.
• Rotate credentials immediately after any suspected exposure or staff access change.
• Keep webhook secrets separate from storefront API credentials.

Responsible disclosure

If you believe you found a security issue, rotate any affected credentials first, then contact Escalative support with clear, non-sensitive reproduction steps. Do not include live secrets, personal data belonging to others, or exploit payloads in your report. Do not attempt destructive testing, data exfiltration, or attacks against other users.

Honest limitations

No online service can promise absolute security. Operators with privileged access to the live application environment may be able to access protected material. Escalative therefore combines encryption, least-privilege access, session controls, monitoring of abuse signals, and your own credential hygiene. Report concerns early and rotate keys when in doubt.