Marketplace security checklist

• Every order, conversation, dispute and payout action checks the actor is the buyer, the seller of that order, or an admin; sellers can only edit their own listings; all IDs from the client are re-verified against ownership (no IDOR); RLS backs the checks.

• Prices, fees and currency are computed server-side from the listing at checkout; client-supplied amounts are ignored; amount = platform_fee + seller_net is a database CHECK.

• Payouts require charges_enabled and payouts_enabled, no open dispute, an elapsed hold window, and pass velocity rules (new seller + high value + new buyer holds for manual review); a per-seller and global daily payout ceiling fails closed.
• Signup, listing creation, messaging and checkout are rate limited; self-dealing (buyer and seller sharing user, device, payment fingerprint or payout account) is blocked; disposable-email and rapid-listing patterns hold new sellers in review.
• Only verified completed orders can be reviewed, one per party per order; rating manipulation (same IP/device cluster, review rings) is flagged; sellers cannot delete reviews, only dispute through reports.

• Listing images are validated by size, MIME and magic bytes, re-encoded server-side to strip EXIF/GPS and active content, and never served from the same origin as authenticated pages.

• Listing text and images are checked against a prohibited-items list before publish for new sellers, reportable by any user, with takedown, repeat-offender strikes and a seller appeal path.

• Buyer addresses and phone numbers are shared with a seller only after payment and only for fulfilment; messages mask emails and phone numbers until the order is paid; personal data is excluded from logs and exportable/erasable per user subject to financial-record retention.

• GDPR (applies to EU users): Buyer, seller and message data are personal data: lawful basis, export and erase endpoints, retention limits on messages, and a clear controller/processor split between platform and sellers.
• Consumer protection and DSA (applies to EU consumers): Clear fees, refund policy, trader identification for sellers, notice-and-action takedown flow and a complaint process.
• Prohibited and regulated goods: Maintain a prohibited-items policy and per-category rules; services and goods in regulated categories need extra checks or exclusion.

• payouts per day cents: global and per-seller daily ceiling (MAX_PAYOUT_PER_DAY_CENTS); release job stops and alerts at the ceiling.
• refund exposure cents: platform-funded refunds capped per day; above the cap refunds queue for admin approval.
• image storage mb per seller: per-plan cap; presigned uploads refused at 100%.
• image processing jobs per seller day: daily cap on processing jobs per seller; over the cap uploads are refused, not queued.
• emails per user day: capped per user and platform-wide; over the cap notifications degrade to in-app only.
• transfers per order: exactly one by unique index; any second attempt is refused.

Forge64 gives every app its own Postgres database and runs a quality gate that flags unauthenticated writes and secrets in client code before you see the app. It does not replace your own testing, and it holds no third-party security certification today.

This is a reference design for the category, not a promise that every item is generated today. Built-ins such as email, background jobs, file uploads and search are coming soon, so anything here that needs them is something you add yourself for now.

• Sign in as two different users and try to open each other's records by changing the id in the address.
• Submit each form with an empty value, a very long value and a script tag, and check the result.
• Call each write endpoint without signing in and check that it refuses.

What is the biggest security risk in a marketplace?

Every order, conversation, dispute and payout action checks the actor is the buyer, the seller of that order, or an admin; sellers can only edit their own listings; all IDs from the client are re-verified against ownership (no IDOR); RLS backs the checks.

Does a marketplace have compliance obligations?

GDPR, if you have EU users: Buyer, seller and message data are personal data: lawful basis, export and erase endpoints, retention limits on messages, and a clear controller/processor split between platform and sellers. This is a starting point, not legal advice.

Will Forge64 certify my app as secure?

No. Forge64 holds no third-party security certification today and does not certify apps. The checklist is a way to test your own app.

• How to build a marketplace
• Marketplace architecture
• Example prompt for a marketplace
• Marketplace scaling checklist
• Often combined: SaaS dashboard
• Often combined: online store
• All app types