How we protect Shopinbos
Data is encrypted in transit and at rest. Sign-in uses one-time codes, so there are no passwords to steal. Staff access to sensitive data is limited and logged.
Card payments go through Paystack, which is PCI DSS certified. We never store full card numbers.
In short: We use encryption, passwordless sign-in and strict access.
Reporting a vulnerability
Email security@shopinbos.com with a description of the issue, the steps to reproduce it, and the impact you think it has. Screenshots or a short video help.
We reply within 3 working days and keep you updated while we fix it.
In short: Email security@shopinbos.com with the details.
Rules for testing
Only test with accounts you own. Don’t access, change or delete other people’s data; if you reach it by accident, stop and tell us.
Don’t run denial of service attacks, spam, social engineering of our staff or sellers, or physical attacks.
Give us reasonable time to fix the issue before you share it publicly.
In short: Test with your own accounts, and don’t cause harm.
Our promise
If you follow these rules in good faith, we won’t take legal action against you or ask the police to investigate, and we will credit you if you want us to.
In short: Good-faith researchers are safe with us.
Scams using our name
Shopinbos will never ask for your one-time code, your bank PIN or your password on WhatsApp, by phone or by email. If someone does, it is a scam: report it to us and don’t share the code.
In short: Never share your one-time code with anyone.
