E-commerce & retailYour support agent refunds, cancels, ships
Your support agent refunds, cancels, ships
based on what it reads.
A customer ticket, a product page, a review: any text the agent reads can contain an instruction (issue a refund, export the customer base, change a delivery address). We check it on your test environment.
Applicable regulations
PCI-DSS
In forcePayment data security standard. Even if your PSP (Stripe, Mollie) handles the payments, you're still on the hook for your environment.
GDPR: customer data
In forceNames, addresses, emails, purchase histories, payment data: your site stores personal data covered by GDPR.
EU Omnibus Directive
In forceTighter transparency and security obligations for online sales platforms in the EU.
Common e-commerce vulnerabilities
- Client-side price manipulation (changing the amount in payment requests)
- Order enumeration through sequential IDs, exposing other customers' orders
- Customer account takeover through insecure password reset
- Promo code bypass (reuse, stacking, negative amounts)
- Product APIs leaking internal data (cost price, margins, exact stock)
- Vulnerable WooCommerce or Prestashop plugins with unpatched CVEs
We regularly find price manipulation flaws on WooCommerce and PrestaShop stores, where order amounts can be changed before they reach the payment processor.