Security

BD.MARKET is built around one principle: every product line shares the same security practices, because they share the same commerce core. There is no weaker storefront to attack.

Payments

Payments are verified server-side, directly with our payment provider, before an order is ever marked paid. We never grant access just because a customer's browser returned from a payment page — that return is a hint, not a confirmation. Our servers confirm the transaction independently, and payment credentials are kept entirely server-side and never exposed to the browser.

Accounts

We use passwordless, email-based login rather than stored passwords — there's no password database to leak. Login links and codes expire quickly and can't be reused, and sessions expire on a schedule designed to balance convenience with risk.

Digital files

Purchased files are stored privately and are never given a permanent public URL. Every download request is checked against your account's entitlements at the time of the request, and access can be revoked or rate-limited if abuse is detected.

Infrastructure

BD.MARKET runs on Cloudflare's network, with bot and abuse protection, rate limiting, and standard security headers applied across every storefront. Our admin systems require multi-factor authentication and enforce role-based permissions.

Reporting a security issue

If you believe you've found a security issue with BD.MARKET, please email support@bd.market with details. We take security reports seriously and will respond as quickly as we can.