Security, how My T Maker protects your store

A designer that takes uploads, stores designs, and touches checkout is a serious surface, I treat it that way. Here’s what’s actually done, in plain language.

The short version

• Runs entirely on your server, no third-party cloud holding your customers’ data.
• No cookies, no trackers, no telemetry. Stats are native WordPress data; no analytics beacon leaves your site and nothing profiles your visitors.
• Every server endpoint went through a dedicated security audit pass before public sale, on top of WordPress’s own security model.

What the audit covered

Every route the designer’s server side exposes was reviewed and hardened:

• Permission checks on every privileged action, admin functions verify the user’s actual WordPress capability; state-changing requests carry and verify nonces (WordPress’s anti-forgery tokens).
• Everything gets cleaned on the way in and checked on the way out, so nothing a customer types can turn into code. SVG uploads get scrubbed too, because a vector file can hide code, and a design tool that takes vector art is exactly where somebody would try it.
• Uploads constrained, type and size limits on design data, with hard per-request caps.
• Public endpoints rate-limited, quote, cart, share, and AI endpoints have per-IP rate limits and honeypot fields, so bots can’t flood your inbox, your database, or your AI bill.
• Unguessable share tokens, shared-design links use random tokens, and stored shares are capped with automatic cleanup so the feature can’t be used to bloat your database.
• Cross-origin requests scoped, browser API access is restricted to your own site.

Data practices

• Customer designs, orders, leads, stats: stored in your WordPress database and uploads folder. You can see, export, or delete all of it with normal WordPress tools.
• No PII in analytics. The stats dashboard counts events (views, quotes, shares), it doesn’t fingerprint or profile visitors, and it sets no cookies. That’s why the designer doesn’t add a cookie-banner burden to your site.
• AI key (if you use AI art): stored server-side in your WordPress options and used only server-to-provider, generation requests are proxied through your own site, so the key never reaches the customer’s browser and never comes to me.
• I can’t see your data. There’s no telemetry channel back to me. Server-side, the plugin makes exactly two kinds of outbound call: checking for plugin updates, and, only if you enable AI Art, your chosen AI provider. (In the browser the designer loads Google Fonts for the display typefaces. Everything else, including the canvas engine, ships inside the plugin and loads off your own domain.)

Your side of the deal

Software security is a partnership. Keep WordPress and PHP current, use HTTPS (your customers are typing names and emails), and keep your license active so security updates keep flowing, see what happens when a license expires.

Found something? Report it privately through the contact form, security reports get priority handling, and I’ll credit you if you want.