security.md

Security and Data Handling

This page defines the safety boundaries agents must preserve when implementing Hexagon-related integrations.

Credential Rules

Keep all Hexagon and merchant credentials server-side. This includes:

HEXAGON_API_KEY
HEXAGON_MERCHANT_ID when it should not be public for the merchant's rollout
commerce platform tokens
Shopify, WooCommerce, Magento, VTEX, BigCommerce, or custom backend credentials
Meta or WhatsApp credentials
payment provider credentials
private catalog export URLs

Do not expose these in:

browser JavaScript
mobile app bundles
generated Markdown pages
public repositories
logs
screenshots
analytics events
AI prompts sent to third-party systems

Payment Data

Hexagon provider discovery does not require raw payment credentials. Do not request or handle raw card numbers, CVC, CVV, bank account numbers, or payment secrets in generated code.

If a merchant checkout flow is in scope, use the merchant's advertised tokenized or delegated payment handler. Ask for explicit buyer approval before payment where an agent is acting on behalf of a buyer.

Product Data

Product data may include commercially sensitive information. Only expose what is needed for the public or channel-specific AI surface:

public product title and description
public images
public canonical URL
public price when appropriate
availability where appropriate
product attributes useful for recommendations

Do not expose supplier cost, private margin, private inventory notes, customer data, or internal merchandising rules unless the merchant explicitly intends that data to be shared through the target surface.

User and Customer Data

Merchants remain responsible for customer notices, consent, opt-outs, retention, deletion, and support obligations. Do not collect more personal data than the flow needs.

For WhatsApp commerce or messaging, comply with Meta and WhatsApp policies, template rules, opt-in requirements, opt-out handling, and local law.

Server-Side Proxy Pattern

For browser or mobile applications:

The client calls the merchant backend.
The merchant backend authenticates the user and validates the request.
The backend calls Hexagon or the commerce platform with server-side credentials.
The backend returns only safe response data to the client.

Never call Hexagon APIs directly from the browser with private credentials.

Logging

Logs should not include:

API keys
access tokens
payment credentials
full customer addresses unless necessary and protected
raw webhook payloads containing sensitive data
private product cost or margin data

Log identifiers, status codes, sync counts, and non-sensitive diagnostics instead.