Security

This website

• HTTPS enforced with HSTS; nothing served unencrypted.
• Strict Content Security Policy (CSP) with a unique per-page token: only our own scripts run.
• Clickjacking protection: the site cannot be displayed inside another site's frame.
• No script, tracker or font loaded from a third-party service.
• Protected contact form: strict server-side validation, origin check, rate limiting and an anti-bot trap.
• Pinned, audited and regularly updated dependencies.

The platform and API

The platform is designed following the OWASP Top 10 and Meta's recommendations:

• encryption in transit (TLS) and of secrets at rest;
• API keys stored hashed, revocable, with limited permissions;
• verification of Meta webhook signatures before any processing;
• strict separation of each customer's data;
• limited, named administrative access, protected by two-factor authentication and logged;
• encrypted backups and an incident response procedure.

Report a vulnerability

Think you have found a vulnerability? Write to securite@ekora.africa describing the issue, the steps to reproduce it and its impact. Our security.txt file is published at /.well-known/security.txt.

• We acknowledge receipt within 3 business days [to be confirmed] and keep you informed of the fix.
• Act in good faith: do not access other people's data, do not modify or delete anything, do not disrupt the service, and give us time to fix the issue before any disclosure.
• Within this framework, we will not take legal action against you.

We do not offer a bug bounty programme yet.