Security Policy

All traffic between your browser and the Chameleon store is encrypted with TLS. Payment details are handled entirely by our payment providers — Alipay, WeChat Pay, or NOWPayments — and we never see or store card or wallet credentials.

Passwords are stored as salted bcrypt hashes and sessions use short-lived signed cookies. Sign-in and registration endpoints are rate-limited to resist credential attacks.

Checkout, order lookup, and registration are protected by rate limiting and — when enabled — Cloudflare Turnstile, an invisible challenge that keeps bots out without interrupting real customers.

If you believe you have found a security issue, email support@chameleon.com with details. We investigate every report and respond within one business day.