Protected connections
The production MakerVista website is served over HTTPS so browser traffic is protected in transit. Authentication is handled through the application’s authentication provider rather than storing plaintext passwords in MakerVista application code.
Server-side secrets
Production credentials and service secrets are kept in server environment configuration and are not intended to be shipped to the browser. Production builds also include checks intended to catch obvious server-secret exposure through public environment-variable names.
Workspace isolation
MakerVista associates customer business data with a workspace and uses server-side authorization and database controls to keep workspace data separated. Regular users do not receive platform-administrator access.
Etsy access
Etsy authorization happens through Etsy. MakerVista never needs your Etsy password. You can disconnect Etsy access from the Connect Etsy Shop page.
Production hardening
Production configuration disables browser source maps, removes unnecessary framework-identification headers, adds security-related response headers, avoids caching sensitive API responses, and rate-limits authentication attempts.
Responsible reporting
If you believe you found a security or privacy problem, please use the Contact page and include enough detail to reproduce the issue without sending passwords or other secrets.