1. Account protection
- Firebase-backed authentication with verified-email controls where configured.
- TOTP multi-factor authentication capability for protected portal roles when enabled through Firebase Authentication with Identity Platform.
- Server-side verification of Firebase identity tokens before protected API actions.
- Role, permission, and page-scope enforcement for employee and Website Studio functions.
- Recent-sign-in requirements for selected high-impact operations.
- Session revocation, account disablement, and a self-service “sign out all devices” capability.
2. Application safeguards
- Protected portal collections are intended to be delivered through authenticated server endpoints rather than embedded in public HTML.
- Website Studio separates private drafts/management history from sanitized public website content.
- Privileged website publishing, rollback, security administration, and catalog changes create audit events.
- Public checkout sends server-approved product identifiers rather than allowing the browser to select arbitrary Stripe Price IDs.
- URL, content, and rich-text validation limit unsafe protocols and script injection.
- Security headers, no-store responses on protected routes, and rate limits are configured for sensitive endpoints.
- Server credentials and payment secrets belong in environment variables and must not be committed into public source files.
3. What users should do
- Use a unique password and protect the authenticator or device used for MFA.
- Do not approve an MFA prompt or code request you did not initiate.
- Sign out on shared devices and use “Sign Out All Devices” if a device is lost or an account may be compromised.
- Keep browsers, operating systems, and downloaded Unity software updated.
- Verify that you are using an official Unity domain before entering credentials.
4. Responsible vulnerability disclosure
If you believe you found a security issue, report it through the contact page and clearly label the subject “Security Vulnerability Report.” Include enough information to reproduce the issue safely, the affected URL or component, potential impact, and a method to contact you.
Good-faith boundaries
- Do not access, modify, download, or retain another person's data.
- Do not use denial-of-service, destructive payloads, malware, credential stuffing, phishing, or social engineering.
- Do not test third-party providers such as Firebase, Google, Netlify, Stripe, merchandise vendors, or storage providers without their separate authorization.
- Stop testing if you encounter sensitive data or obtain access beyond what is necessary to demonstrate the issue.
- This page does not create a bug-bounty promise, safe-harbor contract, or authorization to violate law or third-party terms. Any bounty or special testing authorization must be agreed in writing.
5. Incident response
Unity may revoke sessions, disable accounts, rotate credentials, block routes, preserve audit records, notify service providers, and take other containment steps when a credible incident is detected. Required notices to affected individuals or regulators will be handled according to applicable law and the facts of the incident.
6. No absolute guarantee
No online service can guarantee perfect security. Unity's goal is to reduce risk through layered controls, least privilege, data minimization, monitoring, and timely remediation.