Security you can check yourself.
Every page of fastart.co sends these six headers, and your browser can show them. Below: what else is in place, what isn't, and where to report a flaw.
- X-Frame-Options
- DENY
- No site can show these pages inside a frame.
- X-Content-Type-Options
- nosniff
- Browsers use each file's declared type instead of guessing.
- Referrer-Policy
- strict-origin-when-cross-origin
- Other sites see that you came from fastart.co, not which page.
- Permissions-Policy
- geolocation=(), microphone=(), camera=()
- No page can ask for your location, microphone or camera.
- Strict-Transport-Security
- max-age=31536000; includeSubDomains
- Browsers connect to fastart.co and its subdomains over HTTPS only, for a year at a time.
- X-XSS-Protection
- 1; mode=block
- Older browsers block a page when they detect a script attack; current ones ignore it.
Response headers on fastart.co, checked 8 October 2026. No page-level content security policy.
In place today
Each row is checked in the code, and carries the day it was last looked at.
- Live
Security surface and documents
Security headers on every page and a published address for reporting flaws. No content security policy yet.
- Live
Accessibility and performance thresholds
Accessibility, layout and page-size checks that were run for this site. They don't yet run on every release by themselves.
Not in place
Said plainly, so nobody has to guess.
- No page-level content security policy.
- No payment provider can be connected yet.
- Roles can't be given to people yet.
- No security certificate: ISO 27001 and SOC 2 are planned, and we won't claim them before we hold them.
- No commitment yet on the region that holds store data; it comes with the subprocessor list before the production data path opens.
- No independent audit or continuous monitoring; we'll say so plainly when there is.
How to report a flaw
Write to security@fastart.tech. There's no PGP key yet, so leave passwords and personal data out.
- 01
Gather the details
The address, the steps to reproduce it, and what could happen.
- 02
Send it to us
One report per issue, in English or Turkish, to security@fastart.tech.
- 03
We reply and keep you posted
A person answers and stays in touch until a fix ships. We don't promise a fixed reply time.
What's in scope
This page doesn't authorise intrusive testing and isn't legal advice. If you're unsure, ask first.
In scope
- Reproducible issues on public web pages FaStart runs.
- Misconfigured security headers.
- Sign-in or permission issues shown only with accounts you control.
- Data exposure shown without copying more than the smallest proof.
Out of scope
- Touching real customer data, deleting data or disrupting the service.
- Social engineering, phishing and physical attacks.
- Volume tests (DoS) and automated password guessing.
- Flaws in third-party services FaStart doesn't run.
No paid bounty yet. When there is one, its scope and rewards will be published here.
Questions about security
What is verified today?
Does FaStart store my customers' card details?
Do you hold ISO 27001 or SOC 2?
Can one store see another store's data?
Can everyone on my team see everything?
Where to go next
Found something? Tell us.
Write to security@fastart.tech with the address, the steps and what could happen.