MIST Technology
Security at MIST
Permission boundaries and honest operational evidence.
Workspace isolation
Organization-scoped access rules and protected server checks guard workspace data. Separate platform-admin authority is required for privileged diagnostics.
Source and AI safety
Source, page text and AI output are untrusted. Patches use target allowlists and original hashes. Untrusted validation runs separately from the app; no generated code executes in the main server.
Network and credentials
The scan worker mediates browser requests with restricted-destination checks. Store tokens remain encrypted and server-only. Hosting, containment and live negative-control acceptance still require operator evidence.
Billing and writes
Preview payments are sandbox-only. Live billing and theme changes remain disabled. Shopify scopes alone do not grant permission to mutate a merchant’s store.
Operations and disclosure
Error reporting is installed. Actual worker readiness, backup inventory, restore testing and incident-response ownership are not yet confirmed. Send security reports to support@misttechnology.net or use Contact; never include credentials.