Security and privacy

StockBoss holds two things worth protecting: your supplier credentials, and the files you upload. This page says how both are handled.

Who can reach these screens

Every StockBoss screen requires the manage_woocommerce capability. WooCommerce gives that to Shop Manager accounts as well as administrators.

Keep that in mind when you decide who gets a Shop Manager account. Somebody you hired to process refunds can also open these screens. That is why the protections below are stricter than an administrator-only tool would need.

Uploaded files

Files you upload are stored outside your media library, in a folder that:

• refuses to list its contents,
• denies direct requests, on servers that honour those rules, and
• gives every file an unguessable name, so a file cannot be found by trying likely addresses.

Old copies are deleted when a new one replaces them. Only files StockBoss itself put there are ever removed.

On nginx, the name is the control

The folder's deny rule is an Apache rule, and nginx ignores it. On an nginx server the protection that actually applies is the unguessable filename. That is a real control, but a different one. Worth knowing if your supplier's file is commercially sensitive and you are on nginx.

Credentials

Supplier tokens and passwords are kept in your WordPress options table, in plain text. That is standard for WordPress, which has no key store to put them in. It is the same place every other plugin keeps an API key.

In practice that means anyone with database access has them. Protect your database as you already do; StockBoss does not make it worse. It also takes three precautions of its own:

• Credentials are not loaded on every page. They load only when a supplier actually runs.
• Credentials are never exposed through the REST API.
• Nothing prints a credential. Diagnostics report the names of the headers sent, never their values, because an authorisation header’s value is the token.

When you edit a supplier, the credential box is empty. Leave it empty to keep what is stored, or paste a new one to replace it. Your existing token is never printed back onto the screen.

Why a file path is restricted

Point StockBoss at a file on your own server and it will read csv, txt, tsv, xml and zip. Nothing else.

That is a list of what is allowed, not a list of what is blocked, and deliberately so. A rule shaped like “anything except PHP” still reads wp-config.php. It also reads .env, id_rsa and .htpasswd, none of which have an extension at all. Only the last extension counts, so a file called stock.csv.php is a PHP file.

The restriction matters because StockBoss prints sample values from whatever it reads, so you can check the columns. Pointed at the wrong file, it would print your secrets to the screen.

Why an address on your own network is refused

StockBoss will not fetch addresses inside your own network, on your own machine, or on a cloud provider’s internal addresses.

Without that check, “paste an address and see what comes back” becomes a way to read internal services that were never meant to face the web. Cloud providers keep credentials on exactly such addresses. The check runs again on every redirect, so a safe-looking address cannot bounce the request to an internal one.

If your supplier really is on your private network, WordPress has its own filter for allowing a named host. Adding it is a deliberate step, which is the safe direction: nothing internal is reachable by accident.

Zip files

A zip is unpacked with a ceiling on its size, and the ceiling is checked twice. First against what the archive claims to contain, before a byte is written. Then against the bytes as they are actually written, because an archive built to fill a disk lies about its size.

Entries are written to names StockBoss chooses, not the names inside the archive. An archive cannot decide where its contents land.

What StockBoss sends anywhere

Nothing. It fetches from your supplier and writes to your database. There is no call home, no usage reporting and no third party.

Your supplier sees requests from your server, using the credentials you gave it. That is the same thing they would see from any tool you pointed at them.