Security

Honest account of how CareWP protects your data — written for buyers, not auditors.

API authentication: all non-public API endpoints require a per-account API key (X-API-Key or Authorization: Bearer). Public endpoints are limited to health checks and deliberately public flows (documented in our API reference).
Secrets management: every credential and key is configured via environment variables — nothing is hardcoded, and sample configs ship without real values.
Transport: the service is designed to run behind TLS; we terminate HTTPS at the reverse proxy and never accept credentials over plain HTTP in production.
Payments: checkout and card handling are done by Stripe; card numbers never touch our servers.
Input validation: every endpoint validates and bounds its inputs; malformed requests get a 400, never a stack trace.
Logging: structured logs for operations and security events; no secrets or keys are written to logs.

We are not SOC 2 certified and have not completed a third-party penetration test. We'll say so plainly until we have.
We don't run a bug-bounty program yet.

Email don+carewp@lifeofmorr.com (placeholder — replaced before launch) with details. We aim to acknowledge within 2 business days.