Security at Brand My Bike
Brand My Bike is being prepared as a security-sensitive marketplace. Transactional launch gates remain closed until the legal, operational and independent testing requirements are complete. This page describes controls that are currently implemented; it is not a certification.
1. Payments
Card entry is handled by Stripe-hosted Checkout. Brand My Bike does not store complete card numbers. Signed webhooks—not browser return URLs—are authoritative for payment status. Event IDs, processing leases and idempotency keys protect retries. Bidding, new payments, refunds, transfers and payout onboarding have independent server-side emergency switches. Live Rider transfers remain disabled while their source-charge allocation and reconciliation model is under review.
2. Account security
Passwordless login does not create an account implicitly and returns the same public response for known and unknown email addresses. Sensitive mutations require an authenticated user, server-side authorization, same-origin requests and multi-dimensional rate limits. Administrative MFA and step-up flows remain a launch gate.
3. Ride and location data
Raw FIT/GPX files and full route points are private. Public routes are separate derived data: endpoints are removed, coordinates are reduced, and publication requires an explicit Rider action. Upload processing is disabled until isolated worker and resource-limit acceptance tests are complete. Live locations and home addresses are not published.
4. Files and images
Private buckets, ownership checks, short-lived signed URLs and random object paths protect uploads. Raster images are signature-checked, decoded with pixel limits and re-encoded without metadata. SVG uploads are rejected. Private PDF documents reject active-content structures and are delivered as downloads; malware scanning remains a launch gate.
5. Data minimisation
Public pages use narrow, moderated projections. Payment-event storage is reduced to operational identifiers instead of full provider payloads. Security identifiers used for abuse controls are keyed hashes, and sensitive account/API responses are marked non-cacheable.
6. Report a vulnerability
Please report suspected vulnerabilities privately to hello@brandmybike.com. Include affected URL, impact and safe reproduction steps. Do not access other people's data, test third parties, perform denial-of-service tests or include secrets, payment data or identity documents in email. See the repository security policy and security.txt for scope.