Security
Audited. Patched. Documented.
NivoSync went through a comprehensive 6-wave security audit in early 2026. Every critical and high-severity finding was closed before the public commercial release.
Recent security audit
April–May 2026. 113 findings catalogued, 99 active issues, all closed before launch.
Wave 1 · Crypto and licence integrity
Replaced legacy crypto with AES-256-GCM authenticated encryption, HKDF-SHA256 key derivation, HMAC-SHA256 licence response signatures, and 72-hour grace period for transport-only failures.
Wave 2 · Frontend AJAX and XSS
Hardened all public AJAX endpoints with nonces, rate limits, and reCAPTCHA fail-closed defaults. Eliminated reflected XSS in filter parameters, comparison views, and wishlist email.
Wave 3 · Plugin internals and PHP Object Injection
Every unserialize() call upgraded to allowed_classes => false. Cached data scrubbed before deserialisation. Settings sanitisation and CSRF on every admin endpoint.
Wave 4 · WooCommerce + Ring Builder
Atomic order meta updates, payment gateway compatibility hardening, refund flow with bidirectional Nivoda hold release, HPOS readiness.
Wave 5 · Database schema
Schema versioning via dbDelta, unique constraints on compare and wishlist tables to prevent integer overflow, race-free inserts via ON DUPLICATE KEY UPDATE, composite indexes on hot query paths.
Wave 6 · Bookings addon
Email injection (CRLF) defences, CSV formula injection prefix, atomic cron locking against duplicate reminders, credentials moved out of the webroot, JSON validation of service-account keys, mass-assignment guard on the admin edit page.
Encryption and integrity
AES-256-GCM at rest
Sensitive credentials (Nivoda username and password, API tokens, license-bound shared secrets) are encrypted with AES-256 in GCM mode. GCM provides authenticated encryption — tampering corrupts the auth tag and the plugin refuses to decrypt.
HKDF-SHA256 key derivation
Each encryption context (license, API tokens, transients) gets its own derived key via HKDF, bound to your install's WordPress AUTH_KEY and SECURE_AUTH_KEY. A copy of the encrypted database alone is useless without the entropy from the running server.
HMAC-signed licence responses
Every response from the licence server is HMAC-SHA256 signed with a per-licence shared secret. The plugin verifies the signature before applying any state change. Tampered responses are dropped and logged.
Replay protection
Licence verify and update-check requests include a server-issued timestamp and nonce. Replay outside a 5-minute window is rejected. Domain hash in every request must match the stored binding.
What we collect — and what we do not
What the plugin sends to api.nivosync.com
- Licence key (in transit, never logged in plain)
- Domain (hashed before any storage or logging)
- Plugin version (for update eligibility)
- Anonymous activation status (success / failure for ops monitoring)
What we never see
- Customer names, emails or addresses on your site
- Diamond inventory or pricing data
- Sales transactions or order histories
- WooCommerce database contents
- Any personal data of your store visitors
Full details in our Privacy Policy.
Reporting a vulnerability
If you believe you have found a security issue, please email us directly. We do not run a paid bug bounty in v1, but we recognise responsible disclosure with a public Hall of Thanks once the issue is patched.
We acknowledge within 24 hours and target resolution within 7 days for critical issues.
Machine-readable contact details: /.well-known/security.txt
Compliance posture
GDPR (EU)
Data minimisation, lawful basis, customer rights honoured.
UK Data Protection Act 2018
ICO-registered controller posture.
PCI-DSS
Out of scope. Card data handled by PayPal; we never see card details.
SOC 2
Not yet. May be added when customer demand justifies the audit.