Trust Center
How your purchase is protected
This page is the buyer-facing summary of our security review: what was found and fixed, what risks remain, and the checks that run on a schedule to confirm none of it has drifted. Payment is processed by Paddle as merchant of record. Card numbers and bank details are never seen or stored by this site.
Current status
- Last security audit
- Pending first run
- Checks passing
- Pending first run
- Last delivery audit
- Pending first run
The security audit runs daily and the delivery audit every six hours. Both re-test the live site, not a copy of it, and a failure alerts us immediately.
What was found and fixed
Reader reviews
Submitted email addresses were reachable alongside published review text.
Public access was revoked. The site now reads a restricted view that carries only the display name, rating and review text.
Database access
Several tables carried broader read privileges than the site needed.
Privileges were cut to the minimum per table, row level security is on everywhere, and policies are scoped to the owner account or to server code only.
Payments
Purchase notifications could in principle be replayed or duplicated.
Every payment notification is signature verified, rejected outside a five minute window, and recorded atomically so a duplicate cannot issue a second copy.
Download links
Personal download links appeared in analytics and in the browser address bar.
Links are stripped before analytics is called, cleared from the address bar on arrival, and download pages send no referrer and are never indexed.
Your allowance
A storage failure could consume one of your three downloads.
Delivery fails closed. If your personalised copy cannot be produced, the attempt is not counted against you.
Spam and abuse
Public forms and endpoints had no throttling.
Reviews, reader questions, checklist requests, email resends and download attempts are all rate limited in a shared, persistent store, with CAPTCHA and honeypot checks on public forms.
Files at rest
The book and the printables must never be publicly listable.
Both storage areas are private. Files are served only through short-lived signed links tied to your order.
Administrative access
Owner-only pages needed hard server-side enforcement.
The administrator role is verified on the server for every privileged action, and role data sits in a separate table that cannot be self-assigned.
Risks that remain
No system is without risk. These are the ones we accept, and why we consider them low impact for you.
A buyer can forward their own download link.
Links expire, are limited to three downloads, and every copy is watermarked to the purchaser, so a leak is traceable.
Email delivery is outside our control.
A link can be delayed or filtered by a mail provider. You can request a fresh link yourself, and delivery failures raise an alert to us.
Rate limits are applied per server instance.
They exist to stop spam and probing. No personal data is exposed even if a limit is briefly exceeded.
Receipt links do not expire.
A receipt holds no card data and no download rights, and it is revoked if the order is refunded.
Anyone who buys the book can copy its text.
Each copy carries a forensic watermark and a unique reference, so a leaked copy can be traced to its source.
How it is verified
- Row level security and access privileges are re-checked on every table, daily.
- Book files and printables are confirmed private, with no public listing.
- HTTPS enforcement, framing protection and download link headers are re-tested daily.
- Scheduled job endpoints are probed to confirm they refuse an unauthenticated caller.
- Every package the site is built from is checked daily against the public vulnerability database.
- Checkout, payment notifications, download expiry and the three-download limit are re-tested every six hours.
If you have a concern
Write to welcome@theguestbeforetherest.com. Suspected security issues are reviewed on receipt, and anyone affected is contacted directly. See also our privacy notice , Terms of Use and purchase terms.