Keepsy

Security

Last updated 5 August 2026 · Keepsy is operated by Found.

Least privilege

Keepsy requests exactly the permissions it uses and no more: read access to your account identity, products and orders, plus permission to manage its own webhook subscriptions. It holds no write access to products, orders, customers or discounts, so a bug or a compromise cannot change anything in your store.

Store isolation

Every record Keepsy stores carries the store it belongs to, and every query is scoped by it. Each store install gets its own user record — a single OpoShop owner running two stores gets two entirely separate sets of data, which is exactly the case where cross-tenant leaks happen. The app runs a data-isolation audit at every boot that verifies no saved item can be reached from a different store, and reports it in the logs.

Session security

A Keepsy session is only ever created after ownership of the store is proven with the caller's own credential — either OpoShop confirms the caller owns that store, or OpoShop itself validates the caller inside a signed authorisation exchange. "The store is already connected" is never accepted as evidence, and there is no fallback that would let an unverified request mint a session. Sessions are signed JWTs with a pinned algorithm, and the signing secret must be strong or the app refuses to start.

Shopper lists

A saved list is reachable only with a 256-bit random token held by that shopper's own browser. Typing an email address never returns a list; moving a list to a new device requires opening a signed, expiring link sent to that address. Unsubscribe links are signed and time-limited so an old email archive cannot be used against someone later.

The storefront widget

The widget identifies its own script tag rather than grabbing the first one it finds, so it can never send your shoppers' data to another app's server. It resolves your store from OpoShop's own page configuration, never from the hostname. Every network call and DOM operation is guarded — a failure anywhere leaves your storefront exactly as it was.

Data in transit and at rest

All traffic is HTTPS-only with HSTS. Data is stored in a managed MongoDB Atlas cluster with encryption at rest and access restricted to the application. Secrets are held as platform secrets, never in source control.

Rate limiting and abuse

Public storefront endpoints are rate-limited per client, with a tighter budget for anything that sends email. Malformed requests return a clean 4xx rather than a server error. Exported CSV cells are escaped so shopper-supplied text cannot execute in a spreadsheet.

Reporting a vulnerability

If you find a security issue, please email brandon@tryfound.io with details and steps to reproduce. We will acknowledge within two business days and keep you updated until it is resolved. Please do not publicly disclose before we have had a chance to fix it.