# Security Policy

> How Lucky Store protects your data and systems.

[← Back to Lucky Store](https://www.luckystore1947.com)

---

## Our Security Practices

- **Encryption:** All data is encrypted in transit (TLS 1.3) and at rest
- **Authentication:** Supabase Auth with Row Level Security (RLS) on all tables
- **Infrastructure:** Hosted on Vercel (storefront) and Cloudflare (edge workers, R2 CDN)
- **Database:** Supabase Postgres with automated backups and point-in-time recovery
- **Secret Management:** Environment-level secrets, never committed to source control
- **Monitoring:** Google Analytics, Cloudflare analytics, and Supabase dashboards

## Vulnerability Reporting

If you discover a security vulnerability, please report it responsibly:

- **Email:** [luckystore.1947@gmail.com](mailto:luckystore.1947@gmail.com)
- Include steps to reproduce, impact assessment, and any relevant logs
- We aim to acknowledge reports within 48 hours

## Agent & API Security

- Agent authentication follows the [auth.md](https://www.luckystore1947.com/auth.md) protocol
- OAuth 2.1 discovery at [/.well-known/oauth-authorization-server](https://www.luckystore1947.com/.well-known/oauth-authorization-server)
- API keys and tokens are scoped to specific permissions
- Rate limiting applies per credential

---

See also: [Privacy Policy](https://www.luckystore1947.com/privacy) | [Terms of Service](https://www.luckystore1947.com/terms)