Security & Compliance
Security headers, accessibility compliance, PCI, privacy, and regulatory readiness for storefronts.
7 articles
UK Consumer Law Shopify Checkout: What Must Be Shipped
Shipping a UK consumer law Shopify checkout requires 14-day cancellation rules, pre-pay totals, and CMA review flags: verified August 2026.
Ecommerce Supply Chain Security: Production Checklist (2026)
Hardening ecommerce supply chain security: CycloneDX SBOM generation, GitHub dependency review, npm provenance, and Cosign release signing in 2026.
PCI DSS 4 Headless eCommerce: SAQ Scoping Guide (2026)
How headless engineering teams clear PCI DSS 4 headless eCommerce audits in 2026 — navigating SAQ-A vs SAQ-A-EP and securing Hydrogen or Catalyst.
GitHub VS Code Extension Breach 2026: Engineering Response
GitHub's May 2026 internal breach started with a poisoned VS Code extension on an employee device. Engineering response and policy lessons for teams.
OpenAI Privacy Filter: Production Implementation Guide (2026)
OpenAI Privacy Filter in a Shopify stack: deploy the open-weight PII redaction model to mask customer data before it reaches a cloud LLM, UK GDPR in mind.
Security Headers for eCommerce: The Checklist
The 9 HTTP security headers every eCommerce store needs in 2026 — CSP, HSTS, COEP, COOP, and the Magecart-specific configs that block live skimmer attacks.
European Accessibility Act: eCommerce Compliance
The European Accessibility Act is now in force. Here's what eCommerce stores need to fix for compliance and why accessibility is good for business.