Security

Every connection to this site and to the systems behind it is over HTTPS.

The sign-in and cart cookies are `httpOnly`, so a script on the page cannot read them — the class of attack that steals a session by reading `document.cookie` does not apply.

Every form is validated on the server as well as in the browser. The browser check is for your convenience; the server one is the one that counts, because a form is not the only way to reach an endpoint.

**We never handle card data.** Orders are cash on delivery and there is no card field anywhere on the site, so there is no card data to store, leak or be breached.

We hold no security certification and have not had a third-party penetration test or audit. Rather than imply otherwise with a badge, this page says so.

If you find a security problem with this site, tell us before telling anyone else and we will look at it. Please do not test against real customer orders or accounts.