Security

How Supaffi protects Stripe keys, logins and your affiliates' data.

Self-hosted, your affiliates' data never leaves your server. Supaffi sends no email, moves no money, and only reads your payments from Stripe.

Stripe keys

Each product's Stripe key and webhook signing secret are encrypted in the database with MASTER_ENCRYPTION_KEY. The key lives in .env, readable by root only, never in the database.
Keep that key apart from your database backups. See The encryption key.
Every event Stripe sends is checked against the signing secret. An event that does not verify is rejected and never processed.

Restricted key

Supaffi accepts a full secret key, but a restricted key is safer, and Create the key in Stripe opens Stripe with these permissions already ticked. Everything is read only, except creating the webhook endpoint.

Stripe permission	Access	Why
Charges	Read	Checks whether a sale was refunded before its commission was recorded.
Checkout Sessions	Read	Reads the tax on a one-time sale.
Customers	Read	Matches a sale to its customer and checks whether that customer is excluded.
Disputes	Read	Holds a commission while its sale is disputed.
Invoices	Read	Reads what an invoice charged and whether it is excluded.
Payment Intents	Read	Reads the payment a commission is owed on.
Payment Methods	Read	Spots an affiliate buying through their own link.
Subscriptions	Read	Reads the products a referred subscription bills.
Webhook Endpoints	Write	Creates the endpoint that tells Supaffi about sales.

When Stripe opens the form, check every row above is ticked before you create the key. With a full key, Settings shows a warning and a link to create a restricted one. See Connect Stripe.

Passwords and sessions

Owner and affiliate passwords need at least 12 characters.
Sessions last 30 days. Changing the owner password ends every older owner session.
Affiliates set their password through a link you create. It works once, for 3 days, and creating a new one cancels the old one.
The owner dashboard never answers on a product hostname, and neither dashboard can be embedded in another site.

Rate limits

What	Limit
Owner login	20 requests per address, 10 attempts per email and address, and 100 per email, every 15 minutes
Affiliate signup	20 signups per address per product, every hour
Affiliate link clicks	30 new clicks per address, every 10 minutes

Limits are kept in memory and reset when the app restarts. Behind your own proxy, they depend on it setting the visitor's address correctly. See Use your own proxy.

What is exposed

The database publishes no port. Only the app reaches it.
The app listens on 127.0.0.1:3000 by default. Only the proxies are reachable from outside.
HTTPS certificates are issued only for hostnames that belong to a product, so pointing another domain at your server gets nothing.
The update check is an anonymous read of GitHub's releases page and sends nothing about your instance.

Image attestation

Each release image is built and attested by the repository's release workflow. Verify the one you run with the GitHub CLI:

Terminal

gh attestation verify oci://ghcr.io/ugolbck/supaffi:0.4.0 --repo ugolbck/supaffi

Details in Verify an image.

Report a vulnerability

Report it privately through GitHub's private vulnerability reporting. Do not open a public issue, pull request or discussion for it.

Include the version, the steps to reproduce, and what an attacker gains.
You get a reply within 3 working days. Once confirmed, a fixed release goes out with an advisory crediting you, unless you ask not to be named.
Only the latest release gets security fixes, so keep your instance up to date.

Scope and details are in the security policy.