GitHubTry the demo
Project

Security

Litestore keeps your store's data safe, and you can report a problem to us privately.

Report a vulnerability
0Passwords stored
0Sign-in attempts a minute
0Magic link emails a minute
Sign-in

No passwords to leak

You and your customers sign in with a link sent by email. Litestore never stores a password.

  • You can turn on Google sign-in as well.
  • Litestore checks your role again on every request.

Inbox

Sign in to Your StoreTo ava@example.com
now
YYour sign-in linkClick the button below to sign in. No password needed.Sign inDidn't ask for this? You can ignore this email.
Rate limits

Slow down anyone guessing

Litestore allows 5 sign-in tries and 3 emailed links a minute. After that, people have to wait.

Magic link requests

Live
Sign-in links requested this minute5 / limit 3
Limit
SentSentSentBlockedBlocked
Data

Checked by the database

The database itself blocks some mistakes. Here it stops a refund that's bigger than the order.

Stock always adds up

A stock change is only saved when the old quantity plus the change equals the new one.

Payment history stays put

Payment records can't be edited or deleted.

Refund request

Rejected
Order #1042Paid $120.00
Refunded $80.00Requested $60.00
Write rejectedTotal refunded can't exceed the order total. Nothing was saved.
Currencies always match

A payment must match its order's currency.

Nothing is duplicated

Two customers can't share an email and two products can't share a SKU, even if the case differs.

Self-hosting

When you host it yourself

Litestore protects your data. Keeping the server safe is up to you.

Your part

Ongoing
  • Apply security fixesPull in each fix as soon as we release it.
  • Back up your databaseBack it up regularly, or let your host do it for you.
  • Keep API keys out of your codeStore them as secrets, and replace them if they ever leak.
  • Serve your store over HTTPSVercel does this for you if you host there.

Found a security issue?

Please tell us privately through GitHub rather than opening a public issue.

Report a vulnerability