Security

The security of our modules and our customers is paramount. This page describes the protections built into the module, then our responsible disclosure approach, also available from the module's Security Policy tab.

Protections built into the module

  • Synchronization calls signed with a security key specific to each installation.
  • Inbound webhooks protected by the same key, compared in constant time; Mailchimp requires HTTPS to call them.
  • Cart recovery links signed with a secret key of the shop, valid for 14 days (see Abandoned carts).
  • API key checked before any call, never displayed outside its field.
  • Escaped SQL queries, PrestaShop validation, no native table modified.

Hosting behind a WAF or a WAAP

Ask your technical contact to allow these two routes:

  • index.php?fc=module&module=prestamailchimp&controller=webhook (POST): subscriptions and unsubscriptions sent by Mailchimp, arguments type, secure_key and data. Mailchimp does not publish the addresses of its servers: the route must be allowed whatever the source.
  • index.php?controller=AdminPrestaMailchimp (POST, back office): message sent from the support contact window (module bought on PrestaToolBox), argument message (free text).

🚨 Reporting a vulnerability

We encourage security researchers to analyze our modules and report any vulnerability to us, in line with responsible disclosure best practices. We are committed to identifying and fixing any vulnerability, and to communicating transparently throughout the process.

If you believe you have discovered a vulnerability, report it responsibly through our site, providing as much detail as possible: description, impact, affected version, reproduction steps.

Findings that cannot be reproduced or are not directly related to our modules are not taken into account.

📜 Vulnerability management policy

In accordance with the TouchWeb Charter for Responsible Cybersecurity, we apply the following principles:

  • Acknowledgement of any relevant report within 7 days maximum (CVSS ≥ 7.5).
  • Impact analysis and fix planning within 30 days maximum.
  • Publication of a security advisory with a CVE if the CVSS score is ≥ 7.5.
  • No fix is ever released silently.

We also make these commitments:

  • Not to take legal action against researchers acting in good faith, particularly within the YesWeHack program managed by TouchWeb SAS.
  • To guarantee that no confidentiality agreement, including in white-label contexts, prevents the transparent publication of a security advisory with a CVE identifier.

This transparency is essential to enable the third parties concerned (agencies, merchants…) to meet their compliance obligations, particularly under the PCI-DSS standard or its simplified version SAQ-A.

🛡️ Publication authorization

We expressly authorize TouchWeb SAS to publish, on its official website, information about the fixed vulnerabilities of our modules: CVE identifier, security score, affected and fixed versions, easy-to-deploy patch, and any information useful to protect users.

🔍 Disclosure

Security information is available online.