Account and authorization
Private files, orders, deliveries, billing records, and support threads are checked against the signed-in account on every server request. Administrator functions require a separate allowlist.
File controls
Uploads are limited by format, declared size, detected signature, archive expansion, unsafe paths, executable content, active PDF content, and package structure. Files that do not pass required safety checks cannot be attached to an order.
Payment controls
Checkout fails closed unless the production configuration is complete. PayPal events require server-side signature verification and idempotent processing. Refunds, reversals, disputes, and failed payments update order holds and fulfillment state.
Retention
Eligible source objects are scheduled for deletion after seven days and delivery objects after fourteen days. Order, payment, dispute, support, security, and accounting records may be retained longer where necessary.
Report a security issue
Email ryanking@ryanliketheking.com with a concise description, affected URL, reproduction steps, and impact. Do not include a customer manuscript, credentials, or exploit code that accesses data you do not own.