Platform security
Licensing responses are cryptographically signed; the plugin verifies them offline. Update packages are hash-verified and delivered through short-lived, single-use tokens — never public URLs.
Your store never depends on our availability: validation results are cached with a grace window, and the licensing layer has no code path into storefront operation.
Account security
Passwords are stored as salted scrypt hashes; session tokens are stored only as SHA-256 hashes; authentication, licensing and payment endpoints are rate-limited; payment provider secrets are stored write-only and never rendered back to any client.
Report a vulnerability
Report a vulnerability: security@wooaccount.com. We acknowledge reports within one business day and never treat good-faith research as a breach of the Acceptable Use Policy.