Security & Anti-Fraud Controls
Effective date: 2026-08-09
Payments
| Control | Implementation |
|---|---|
| Card data | Stripe Checkout only — never posted to our forms |
| Webhooks | Stripe-Signature verification required; reject unsigned |
| Secrets | `billing/.env.stripe` gitignored; production secrets in host vault |
| Isolation | Epic price IDs only — not shared with other apps |
| Radar | Stripe Radar enabled on live account (Dashboard) |
Product access
| Control | Implementation |
|---|---|
| Local code | Private GitHub; invite only after paid `repo_access` |
| Local usage fees | Disabled by policy (`mode=local`) |
| Hosted use | Entitlement check `GET /v1/entitlement?mode=production` |
| Admin grants | `EPIC_BILLING_ADMIN_SECRET` required |
Seedance / AI video (prepaid)
| Control | Implementation |
|---|---|
| No free gens | Debit `POST /v1/media/debit` before Cloudflare AI run |
| Debit auth | Shared secret `EPIC_MEDIA_SECRET` (or admin secret) on debit only |
| Idempotency | `jobId` recorded; replay does not double-charge |
| Checkout | Stripe Checkout only; plan metadata `seedance_*` |
| Prompt policy | Gatekeeper deny-list + provider safety; AUP enforcement |
| Secrets | AI token / media secret as Worker secrets — never git |
| Rate limits | Checkout + debit endpoints rate-limited |
Deployed (production) checklist
1. `EPIC_DEPLOYMENT_MODE=production`
2. `EPIC_BILLING_API_URL=https://…` HTTPS only
3. `STRIPE_SECRET_KEY=sk_live_…`
4. Webhook endpoint HTTPS + `STRIPE_WEBHOOK_SECRET`
5. Strong `EPIC_BILLING_ADMIN_SECRET` and `EPIC_MEDIA_SECRET`
6. Stripe prices: `STRIPE_PRICE_SEEDANCE_CLIP` / `_PACK_5` / `_PACK_20`
7. Custom Gatekeeper vars: `BILLING_API_URL`, `PUBLIC_SITE_URL`; secrets for media + AI
8. No debug stack traces to clients
9. Rate-limit checkout, entitlement, and media debit endpoints
10. Cloudflare WAF / bot fight on public OS host when available
User scam prevention
- Clear product copy: what is / is not included
- No “get rich” claims
- Terms, Privacy, Refund, AUP linked from white page and Checkout success messaging
- Support email for disputes before chargebacks
Incident response
1. Rotate Stripe restricted keys if leaked
2. Revoke compromised GitHub invites
3. Freeze entitlements for fraudulent emails
4. Notify affected users if personal data exposure
Contact security issues: epictechai@gmail.com (subject: SECURITY)