Security

VendorPrism uses a least-privilege, read-only integration design.

Authentication and secrets

Seller authorization uses Amazon’s documented OAuth/LWA flow. Client secrets, refresh tokens, AWS signing credentials, and access tokens are supplied through an owner-managed secret store or environment, never committed to source control, and never shown in diagnostics. Access tokens are held in process memory and refreshed before expiry.

Transport and resilience

Production requests use HTTPS and AWS Signature Version 4. Rate-limit and transient server responses use bounded retry/backoff. Missing authorization, incomplete provenance, and missing economic fields fail closed.

Scope

The application does not perform seller mutations, listing operations, orders, payments, or supplier communications. Security controls and incident procedures must be reviewed by the owner before public submission.

Security contact

Report security issues to ozzycaptan@gmail.com. Do not include credentials in a report.