Security and reporting a vulnerability

Email security@keyvey.app with the steps to reproduce and the version affected. We aim to reply within 3 business days and to ship a fix for confirmed high-impact issues within 30 days. Please give us that time before telling anyone else.

In scope

• The Keyvey WordPress plugin (latest release).
• The Keyvey billing service and this website.

Out of scope

• NinjaTrader, Sierra Chart, WordPress, WooCommerce, Stripe, Whop and PayPal themselves (report to them).
• Denial of service, spam, social engineering, and reports from automated scanners with no working proof.

Safe harbor

If you act in good faith, only test against your own site or our demo, don't access or keep other people's data, and give us time to fix, we won't pursue legal action. We can't offer paid bounties yet, but we're glad to credit you.

Our official addresses

We only use keyvey.app (this site), billing.keyvey.app (checkout, your key and the billing portal, which runs on Stripe at checkout.stripe.com and billing.stripe.com) and the email addresses matt@keyvey.app and security@keyvey.app.

• We will never ask for your password, your WordPress login, your platform credentials, your card number or a one-time code, by email or any other way.
• We never ask you to pay by gift card, crypto or bank transfer, or outside Stripe.
• We don't change account details (email, site, plan) because of an email alone; we confirm with the email address already on file first.
• Get the plugin only from this site or your own Keyvey account. "Free premium" or "nulled" copies from other sites can carry malware.
• Treat your plan key like a password. Support never needs it; a screenshot of Keyvey → Health is enough.

If something claiming to be us doesn't match this (a look-alike domain, a "Keyvey support" account on social media or a marketplace, a copy of the plugin sold elsewhere), don't reply, click or pay. Forward it to security@keyvey.app. If you already shared a plan key, tell us right away; if you shared a platform token or webhook secret, rotate it in that platform.

Name and logo

Keyvey™ and the Keyvey logo are trademarks of the seller named in our terms. The plugin is GPL, so anyone may fork the code, but not under the Keyvey name or logo. A product called Keyvey that isn't sold at keyvey.app is not ours.

Your platform logins stay on your site

Keyvey (the company) never receives or can see your Sierra Chart login, your NinjaTrader token, or your Stripe, Whop or PayPal secrets. They stay on your own WordPress site, under your control.

• Encrypted on your site. Saved logins are encrypted in your site's database and are never shown again after you save them. The settings page only says "saved" (or the last 4 characters of a long token).
• Sent only where they belong. Your Sierra Chart login goes only to sierrachart.com, and your NinjaTrader token goes only to NinjaTrader, both over HTTPS. Nothing is ever sent to keyvey.app or billing.keyvey.app. A paid plan sends billing only its plan key and your site's domain.
• Kept out of logs. Logins are hidden from the audit log, error messages, emails, exports and the Health page.
• Removed when you say so. Disconnect in Settings deletes a login at once. Deleting the plugin deletes every saved login, even if you choose to keep your license data.
• Only administrators. Only site administrators can save, test or remove logins. Shop managers and editors can't.
• Optional extra key. To keep logins out of the database entirely, define them in wp-config.php (for example KEYVEY_SC_ADMIN_PASSWORD). Or add your own encryption key there as KEYVEY_SECRET_KEY (32+ random characters). See the install guide.

What this can't do: anyone who is an administrator on your site, or who can read both your database and wp-config.php, can use the logins your site uses. Keep administrator accounts few and protected with strong passwords and two-factor sign-in.

Support never needs your logins. If you ever send one to us by mistake, change that password in the platform and delete the message. We'll delete our copy too.

How the plugin protects you

• Platform credentials and webhook secrets are encrypted at rest with your site's secret keys and never shown again after saving (details).
• Stripe, Whop and PayPal webhooks are signature-checked over the raw body, with a 5-minute replay window and duplicate protection.
• Every admin action checks permissions and a one-time token.
• No telemetry. Plan keys are checked offline; paid sites send only the plan key and the site's domain to billing.keyvey.app about once a month to fetch the renewed key.

Machine-readable contact: /.well-known/security.txt