Monifyd
Security
Protect API keys, payment events, user accounts, and transaction data.
API keys
API keys are generated from cryptographically random bytes. Monifyd stores the SHA-256 hash, shows the full key once, and applies plan-based request limits. Keep keys on your server, never in browser code, and revoke keys you no longer use.
Payment events
Webhook deliveries include an HMAC-SHA256 signature over the timestamp and raw event body. Signing secrets are encrypted before storage and unavailable to authenticated database clients. Verify the signature before acting on an event, reject old timestamps, and deduplicate by event ID. Delivery retries can produce duplicates.
User accounts
Dashboard sign-in uses Supabase authentication. Workspace roles determine what members can do, and database row-level security scopes access to workspace records. Service-role credentials are used server-side and must not be exposed to the browser.
Transaction data
Payment status changes and their history are updated together. Settlement records, fee entries, notifications, and audit entries commit together or fail together. Database access policies restrict transaction records to the merchant workspace. Confirmation status depends on blockchain data from external network providers.
Webhook delivery
Webhook endpoints must use HTTPS. Before delivery, Monifyd rejects private and reserved IP ranges, pins the connection to the validated public IP, and does not follow redirects.
Non-custodial wallets
Funds go directly to merchant receiving addresses. Monifyd does not request or store private keys, seed phrases, or wallet passwords. Receiving addresses and transaction hashes are public blockchain data.
Report a security issue
Please report suspected vulnerabilities to monifyd1@gmail.com. Include reproduction steps and the affected URL or component. Do not include customer secrets, API keys, private keys, or seed phrases.
Security limits
These measures reduce risk but cannot eliminate it. Blockchain transactions may be irreversible, and external RPC, email, hosting, and billing providers have their own security and availability characteristics.