Security

Nishvault keeps public product previews separate from private fulfillment, and it treats payment/provider credentials as non-public operational secrets.

Public Pages

Public product pages may show sample rows, file names, price, checkout CTA, payment method explanation, and support links. They must not expose private product downloads, API keys, email provider tokens, Telegram bot tokens, admin tokens, fulfillment secrets, private keys, or payment provider credentials.

Payment References

Checkout forms can collect a buyer email, product title, payment reference, and fulfillment note. Buyers should not submit passwords, private wallet keys, seed phrases, or unrelated sensitive personal information. Public verification pages, when used, should expose only the limited fields needed to verify the artifact.

Gated Fulfillment

Full product files remain outside public static download paths unless public downloads are intentionally enabled. The preferred model is private fulfillment or R2 signed delivery after payment/reference matching.

Automation Guardrails

Secret scans, quality gates, checkout readiness checks, and technical SEO audits should run before live deploys. If a secret leak, quality debt, or SEO failure appears, deploy and outreach should stop until the issue is fixed.

Operational Limits

Outbound email should only send through a verified provider with suppression, unsubscribe, bounce, and daily limit controls. Affiliate programs requiring login, CAPTCHA, or 2FA stay in a human-handoff queue instead of bypassing security.

Product Kits