Security at ApeStore.lk

At ApeStore.lk, we take the security and privacy of our customers seriously. We use industry-standard security practices to protect our website, customer information, accounts, orders, and payment-related data.

1. Our security practices

• HTTPS / TLS encryption: all connections to ApeStore.lk are encrypted using HTTPS/TLS to protect information transmitted between customers and our website.
• Secure authentication: customer accounts are protected using secure authentication and password hashing. Rate limiting and other protections are used to help prevent unauthorized access.
• Two-factor authentication and passkeys: customers can add an authenticator app or a passkey to their account. Administrator access always requires a second factor.
• Password protection: new passwords are checked against lists of commonly used passwords, and we never store passwords in readable form.
• Secure payments: payment card information is processed through our payment provider. ApeStore.lk does not store customers' full card details on our servers.
• Security headers: we use security headers including Content Security Policy, HSTS, clickjacking protection, and other browser security controls where applicable.
• Data protection: customer and order information is stored using access controls designed to prevent unauthorized access.
• Website security monitoring: our website and dependencies are regularly reviewed for known security vulnerabilities.
• Dependency monitoring: third-party software and libraries are monitored and updated to address known security issues.
• Audit logging: changes made by administrators, and failed sign-in attempts, are recorded so they can be investigated.
• Access control: administrative access to our systems is restricted to authorized personnel and protected using appropriate authentication controls.
• Cloud and infrastructure security: our infrastructure uses security controls designed to protect our website, databases, files, and other services.
• Backup and recovery: important website and business data is backed up to support recovery in the event of accidental data loss or service disruption.

2. Security standards

Our security practices are informed by industry-recognized security guidance, including:

• OWASP ASVS: our application has been reviewed against the OWASP Application Security Verification Standard (ASVS) 5.0, Level 1 and Level 2 requirements.
• OWASP API Security Top 10 (2023): our API has been reviewed against each of the ten API risk categories.
• OWASP Top 10 web application risks
• TLS security best practices
• Secure software development practices

We regularly review our website and infrastructure to identify opportunities to improve security, and we repeat these reviews as the application changes.

3. Security testing

We use automated and manual security testing to identify potential vulnerabilities in our website and infrastructure.

Website security

• Mozilla HTTP Observatory: security configuration testing
• Qualys SSL Labs: TLS/SSL configuration testing
• Security Headers: HTTP security header analysis
• Google Safe Browsing: website safety and reputation monitoring
• VirusTotal: multi-engine URL and domain reputation checks

Application security

We review the application against common web application vulnerabilities, including:

• Authentication vulnerabilities
• Authorization and access-control issues
• Cross-Site Scripting (XSS)
• SQL Injection
• Cross-Site Request Forgery (CSRF)
• Insecure file uploads
• Session security
• API security
• Sensitive data exposure
• Security misconfiguration

Dependency and code security

We regularly review third-party components used by ApeStore.lk, including:

• Web framework and runtime (Next.js, React, Node.js)
• Server-side and JavaScript packages
• Database and authentication services
• Payment, delivery, email and SMS provider integrations

Automated checks run on our code changes:

• Dependency vulnerability scanning on every change
• Secret scanning to catch accidentally committed credentials
• Automated dependency update proposals
• Automated tests, including security-focused tests

Known security vulnerabilities are reviewed and addressed through updates or other appropriate mitigations.

4. Payment security

ApeStore.lk uses trusted payment providers to process online payments.

Payment information is transmitted securely to the applicable payment provider. We do not intentionally store customers' full payment card numbers, CVV codes, or other sensitive card authentication information on our servers.

For payment-related security, we rely on the security controls provided by our payment partners in addition to our own application security controls.

5. Responsible vulnerability disclosure

If you discover a potential security vulnerability affecting ApeStore.lk, please report it responsibly.

Security contact: security@apestore.lk

Please include:

• A description of the vulnerability
• The potential security impact
• Steps required to reproduce the issue
• The affected URL, endpoint, or feature
• A proof of concept where appropriate

Please do not:

• Access, modify, download, or delete another customer's data
• Perform denial-of-service attacks
• Attempt social engineering
• Send spam or malicious traffic
• Publicly disclose the vulnerability before we have had reasonable time to investigate and address it

We will review legitimate security reports and work to resolve confirmed vulnerabilities as quickly as reasonably possible.

6. Security.txt

Our machine-readable security contact information is available at https://www.apestore.lk/.well-known/security.txt

7. Security updates

Security is an ongoing process. We continuously review our infrastructure, application, dependencies, and security controls and improve them as new threats and vulnerabilities emerge.

If you have a security-related question, please contact security@apestore.lk.

ApeStore.lk — Secure. Trusted. Sri Lankan.