Built to be trusted

Every file a seller uploads passes these checks before it can be attached to a listing:

• Type allow-list. Only a fixed set of image, document, text, archive and media types is accepted. SVG and HTML are excluded because a browser would execute script inside them.
• Content-signature check. The declared type must match the file's real leading bytes. A declared type with no known signature is rejected rather than trusted.
• Executables and scripts refused outright. Windows PE/EXE, Linux ELF, macOS Mach-O, Java class files and #! scripts are rejected regardless of the declared type — before any other rule runs.
• Archive inspection. ZIP-family files are opened structurally: path-traversal entries, absolute paths, null bytes in names, excessive entry counts or depth, and zip-bomb expansion ratios are refused.
• Ownership. A listing may only reference a file the seller's own account owns; the check fails closed.

These are integrity checks on the container, not a judgement about what is inside it. That judgement is the human review every listing gets, and the seller's warranty in theSeller Agreement.

• One account system. Sign-in is an OAuth 2.1 authorization-code flow with PKCE against EternalEngine's own auth service; scrollforge.io never sees your password.
• Server-held session. The access token lives inside an AES-256-GCM-encrypted sf_session cookie that is HttpOnly, Secure and SameSite=Lax; page scripts cannot read it, and every API call is proxied server-side with the token attached there.
• Return paths are sanitised. The page you are sent back to after sign-in is validated against an open-redirect check.
• Global sign-out. "Sign out" is a same-origin form post that revokes the token, clears the session, and ends the EternalEngine app session too.
• Silent sign-in cannot loop. The one-time silent check sets its marker cookie before it redirects, so a failed round-trip can never repeat.

Password, two-factor, passkeys and active-session management live in the EternalEngine app's account settings, which this site links to rather than re-implements.

• Security headers on every response: a Content-Security-Policy with frame-ancestors 'none' and X-Frame-Options: DENY (no page of this site — the sign-in box included — can be shown inside another site's frame), X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin and a Permissions-Policy that disables camera, microphone and geolocation.
• A strict Content Security Policy on every page. Scripts and styles run only if they come from this site or are one of the exact inline pieces the page was built with (each pinned by its SHA-256 hash — no 'unsafe-inline'). The only other sources allowed are the ones Stripe and Cloudflare Turnstile publish for their own widgets. An injected script is refused by your browser.
• No caching of signed-in responses. Every /auth/*, /api/* and /account/* response is Cache-Control: no-store.
• Same-origin images. Listing images are proxied through this site by file id; only image bodies are relayed.
• No third-party scripts, except Stripe and Turnstile. Fonts are self-hosted, there are no analytics or advertising scripts, Stripe.js loads only on a paid listing when you are signed in and on the seller payout page, and Cloudflare Turnstile loads only inside the sign-in box when the bot check is switched on. See Cookies.
• Every input is schema-validated at the site's own routes before it is forwarded, and the backend validates again.

• No antivirus or malware scanning of uploads. The scanner exists in the storage service but is switched off in every environment. Files are type-, signature- and structure-checked, then human-reviewed — not scanned.
• No static analysis of sold software. Code is read by a reviewer, not machine-analysed.
• No signed packages and no "verified publisher" badge. Seller identity is verified through PayGate for payments; it is not attested to buyers cryptographically.
• No per-listing takedown button. Today a published listing is removed by suspending its seller (which hides all of that seller's listings) or by asking the seller to archive it. A single-listing action is planned.
• No in-page report button — reports are by email, per Moderation & reporting.
• No bug bounty payouts. We run coordinated disclosure with the response targets below, without a reward programme.
• No certifications of the marketplace itself. PCI card-data scope sits with PayGate's payment partner, as card data never reaches us. SOC 2 and ISO 27001 are on the platform roadmap, not earned.

When a vulnerability is confirmed, the clock starts. These are the internal remediation targets our engineering process is built around, shared with the EternalEngine platform:

Everything above sits on the EternalEngine platform: the same auth service, the same gateway, the same database and the same engineering gate that enforces tenant isolation, parameterised queries, validated inputs and no secrets in code or logs on every change. Its security page describes those layers, the vulnerability-response commitments in writing, and the compliance status — OWASP ASVS and NIST SSDF aligned today; GDPR in progress; SOC 2 and ISO 27001 on the roadmap. We will never display a certification we have not earned.

EternalEngine security ·Data Processing Agreement ·Privacy Policy ·Your data & requests