Report a vulnerability
Found a vulnerability in affilinode, the dashboard, the API or the WordPress plugin? Please report it to us confidentially before publishing it. Describe what is affected and how the problem can be reproduced.
Reports to: support@affilinode.com
Please do not access other people’s data, do not disrupt operations and only test with your own account. This information is also available machine-readably in security.txt.
How we protect accounts and data
- Two-factor sign-in is mandatory for all members of an account.
- Team roles: what a member may do in the account depends on their role.
- Separated tenants: each account’s data is separated from all others in the database by row-level security.
- Embed keys are read-only and only work on the domains you have approved.
- Webhooks to your WordPress are signed (HMAC) and protected against replay.
- The WordPress plugin requests product data server-side and never sends your visitors’ IP addresses, cookies or e-mail addresses to affilinode.
- Data export at any time: your data belongs to you and can be downloaded in full.
- Hosting in Germany: Our servers are located in the netcup GmbH data centre in Germany. Traffic between browser, plugin and service is encrypted with TLS; passwords are stored only as hashes.
- Short log retention: Server logs are deleted after 30 days. The activity overview in the dashboard shows important events in your account.