Security at Hobbsy

Authentication & sessions

• Credentials use bcrypt at cost factor 12. Session cookies are HttpOnly, Secure (in production), and SameSite=Lax.
• Cross-product Single Sign-On (Hobbsy ↔ Inventory Hub) uses short-lived JWT tokens (15-min TTL) signed with a per-environment shared secret of at least 32 characters.
• Personal Access Tokens (PATs) for MCP / script integrations are stored as SHA-256 hashes; the raw token is shown exactly once at create time and cannot be recovered. Tokens are revocable at any time from /seller/integrations.

Payments

• Buyer card details are handled exclusively by Stripe Checkout. Hobbsy never sees, stores, or processes raw card numbers.
• Stripe webhook payloads are HMAC-verified using the environment-specific signing secret. Webhook handlers are idempotent against the Stripe event ID.
• Seller payouts go through Stripe Connect Express; sellers complete KYC directly with Stripe.

Data & database

• Postgres roles enforce least privilege: the application role (hobbsy_app) has full CRUD on the marketplace schema but no DDL. Migrations run as a separate elevated role.
• A dedicated read-only role (prisma_ro) is provisioned by schema migration for diagnostics; production rotates its password at cutover.
• Per-role statement_timeout (30s) and connection limits cap the blast radius of slow-query DoS or runaway processes.
• Both Hobbsy and the Inventory Hub use per-app non-superuser roles. A breach in one product cannot reach the other product's database even when they share a Postgres cluster.

MCP integrations

Hobbsy publishes two first-party Model Context Protocol (MCP) servers — @hobbsy/mcp-seller and @hobbsy/mcp-admin — that let sellers and operators manage Hobbsy from any MCP-compatible AI assistant. Tool inputs are Zod-validated; authentication uses Personal Access Tokens scoped to the calling user.

Tool outputs from MCP can include user-supplied content (listing descriptions, shop names, message bodies, review text) that flows back into the calling AI agent and the operator's terminal. Four hardening layers apply to every MCP tool return:

• Output sanitization.ANSI escape sequences, ASCII control characters, zero-width Unicode, and bidirectional-override characters are stripped before any string is returned. This prevents terminal-hijack attacks via malicious user content (e.g. a listing description containing ANSI "clear screen" codes).
• Boundary-tagged user content. User-authored fields are wrapped in explicit <user_content field="...">...</user_content> tags so the calling AI agent can recognize the bytes as data rather than instructions. This bounds the blast radius of prompt-injection payloads buried in user content; it does not claim to fully prevent prompt injection (no client-side mitigation can).
• Security directive prepended to every response. Every MCP tool return begins with a <security_directive> block instructing the calling agent not to advise the user on circumventing security controls, escalating privileges, exfiltrating data belonging to other accounts, or attempting such actions itself. This is a soft counter to prompt-injection at the agent layer — it raises the bar against an agent being talked into helping an attacker, on top of the data-vs-instruction boundary tagging above. Like all client-side mitigations, it is defense in depth, not a guarantee.
• Response size cap. Each tool return is capped at 200 KB to prevent memory pressure or context-window exhaustion on the calling agent.

Both MCP servers are first-party packages in the Hobbsy monorepo and audited via the same PR review as the rest of the codebase. We do not depend on third-party MCP servers and recommend you treat any third-party MCP package the same way you treat any unsigned executable.

AI features

• AI calls (listing draft, description optimization, pricing suggestion, translation) go to Anthropic's API with per-seller daily / monthly budget caps.
• Personal data never reaches an AI model.Every AI feature operates solely on product and listing content — an item's photos, title, description, category, tags, and materials. Names, contact details, addresses, order history, and payment information are never part of any model input (audited across every model-invocation site; see the privacy policy's "AI and Automated Processing" section).
• A circuit breaker opens automatically if the vendor returns elevated error rates and short-circuits subsequent calls until the vendor recovers.
• AI failure classification distinguishes vendor-side issues (Anthropic) from our integration. The user-facing copy is differentiated, and the operator's observability stack only alerts on our-side issues.

Observability

• Structured logs ship to Axiom with a 30-day retention window. PII is redacted at the log layer (passwords, session tokens, authorization headers, payment provider keys, set-cookie).
• Exception capture (Sentry) is throttled per-fingerprint to stay under the SaaS quota; the full event volume always reaches the log drain.
• Every log line carries a requestId that correlates the API request with downstream worker job lines.

Reporting a vulnerability

If you find a security issue in Hobbsy or one of our MCP servers, please report it via our contact form with subject SECURITY DISCLOSURE or email the address listed on that page. We acknowledge reports within 72 hours and aim to ship a fix or mitigation within 7 days for issues classified as High or Critical.

We do not currently run a paid bug-bounty program but we welcome responsible disclosure. We will publicly credit researchers who disclose responsibly, with their permission.

Please don't exfiltrate user data, modify or destroy data, run automated scanners that materially affect availability, or access more than the minimum data needed to demonstrate the finding. Good-faith research within those bounds will not be pursued legally.

Changes to this page

Material changes to our security posture are summarized here when they ship. The canonical engineering controls live in the repo at /help and the company-internal runbooks; this page is the public summary.