Security at Shevris
We build subscription software, so we treat security as part of the product — not an afterthought.
Report a vulnerability
If you've found a security issue in shevris.com, tijarah.pk, or any Shevris system, email hello@shevris.com with steps to reproduce. We acknowledge reports within three business days and keep you updated through triage and fix.
- Don't access, modify, or delete data that isn't yours, and don't degrade service for others.
- Give us reasonable time to fix before any public disclosure — we'll tell you when it's resolved.
- Machine-readable contact and expiry: /.well-known/security.txt (RFC 9116).
How we build
No long-lived cloud credentials
CI authenticates to AWS through short-lived OIDC tokens. No access keys are stored in pipelines or repositories.
Secrets live in a secrets manager
Application and database credentials are fetched from AWS Secrets Manager at boot — never committed, never in images.
Health-gated blue/green deploys
Every release deploys alongside the running version, passes health checks, then switches — with automatic rollback on failure.
Dependency quarantine
Updates ship through Dependabot on a release-age cooldown, so brand-new compromised versions can't land before they're vetted.
Minimal attack surface
shevris.com is a fully static export — no server-side runtime, no database, nothing to inject into on the marketing site.