Security & Anti-Fraud Controls
Effective date: 2026-08-09
Payments
| Control | Implementation |
|---|---|
| Card data | Stripe Checkout only — never posted to our forms |
| Webhooks | Stripe-Signature verification required; reject unsigned |
| Secrets | `billing/.env.stripe` gitignored; production secrets in host vault |
| Isolation | Epic price IDs only — not shared with other apps |
| Radar | Stripe Radar enabled on live account (Dashboard) |
Product access
| Control | Implementation |
|---|---|
| Local code | Private GitHub; invite only after paid `repo_access` |
| Local usage fees | Disabled by policy (`mode=local`) |
| Hosted use | Entitlement check `GET /v1/entitlement?mode=production` |
| Admin grants | `EPIC_BILLING_ADMIN_SECRET` required |
Deployed (production) checklist
1. `EPIC_DEPLOYMENT_MODE=production`
2. `EPIC_BILLING_API_URL=https://…` HTTPS only
3. `STRIPE_SECRET_KEY=sk_live_…`
4. Webhook endpoint HTTPS + `STRIPE_WEBHOOK_SECRET`
5. Strong `EPIC_BILLING_ADMIN_SECRET`
6. No debug stack traces to clients
7. Rate-limit checkout and entitlement endpoints
8. Cloudflare WAF / bot fight on public OS host when available
User scam prevention
- Clear product copy: what is / is not included
- No “get rich” claims
- Terms, Privacy, Refund, AUP linked from white page and Checkout success messaging
- Support email for disputes before chargebacks
Incident response
1. Rotate Stripe restricted keys if leaked
2. Revoke compromised GitHub invites
3. Freeze entitlements for fraudulent emails
4. Notify affected users if personal data exposure
Contact security issues: epictechai@gmail.com (subject: SECURITY)