Platform Trust Center
Overview
At BigCommerce, ensuring your information is private, safe and secure is our top priority. Every day, every store, every request, every visitor, every purchase, we are committed to the security of your e-commerce store. We also create privacy and security tools for your online store so you're in control.
Save time and money with an e-commerce platform designed with the secure functionality your business needs. With more built-in features than other leading platforms, BigCommerce gives you the power to grow your business securely from day one.
Compliance
Documents
Risk Profile
Product Security
Reports
Completed Forms
Data Security
App Security
Legal
Access Control
Infrastructure
Endpoint Security
Network Security
Corporate Security
Policies
Security Grades
Trust Center Updates
GitHub revealed on 4/15/2022 that an attacker is using stolen user tokens (issued to Heroku and Travis-CI OAuth) to download data from private repositories. BigCommerce can confirm that we have conducted an internal investigation and we have no evidence of impact. BigCommerce will continue to monitor the situation closely and will provide updates where we have them available to us.
Reference: https://status.heroku.com/incidents/2413 https://github.blog/2022-04-15-security-alert-stolen-oauth-user-tokens/
The PCI Security Standards Council published version 4.0 of the PCI Data Security Standard (PCI DSS) The updated standard and Summary of Changes document are available now on the PCI SSC website. https://www.pcisecuritystandards.org/document_library?category=pcidss&document=pci_dss
VIEW: “PCI DSS v4.0 At a Glance” an overview document on the changes to PCI DSS v4.0. https://www.pcisecuritystandards.org/documents/PCI-DSS-v4-0-At-A-Glance.pdf
Published on 3/31/2022 BigCommerce became aware of a recently disclosed CVE-2022-22965 - “SpringShell” RCE vulnerability in spring-beans before 5.2.20/5.3.18, BigCommerce can confirm we have conducted an internal investigation and can confirm that we have no evidence that BigCommerce customers or internal employees have been targeted or impacted by this vulnerability.
BigCommerce will continue to monitor the situation closely and will provide updates where we have them available to us.
BigCommerce values the security of its services extremely highly and to this end we maintain appropriate industry accepted third party accreditation of our security controls and program.
Published on 3/31/2022 BigCommerce has been made aware of both the recent potential Okta security incident and the recent potential Microsoft security incident and is actively assessing the situation as events unfold.
We have been in touch with OKTA and have no evidence of impact to BigCommerce. We have researched the Microsoft issue and found no evidence of impact to BigCommerce. We continue to monitor the situations closely and will provide updates where we have updates available to us.
OKTA Statement: https://www.okta.com/blog/2022/03/updated-okta-statement-on-lapsus/ Microsoft Statement: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
The US Cybersecurity & Infrastructure Security Agency provides guidance for organizations to prepare for, respond to, and mitigate the impact of cyber attacks during this period of unrest. https://www.cisa.gov/shields-up
SECURITY NOTICE (click to expand): about the recently disclosed Log4j vulnerabilities, references: https://www.cisa.gov/uscert/apache-log4j-vulnerability-guidance, https://logging.apache.org/log4j/2.x/security.html and: https://nvd.nist.gov/vuln/detail/CVE-2021-44228 https://nvd.nist.gov/vuln/detail/CVE-2021-45046 https://nvd.nist.gov/vuln/detail/CVE-2021-45105 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4104
Exploits related to vulnerabilities affecting Apache’s Log4j, known as "Log4Shell" and "log4shell" were publicly disclosed on December 9, 2021.
There have been reports confirming that active scanning and exploitation attempts are occurring in the wild across a variety of Internet connected systems, separate and unrelated to BigCommerce systems.
BigCommerce has been working diligently to assess our internal systems and 3rd party dependencies in order to mitigate what has become a ubiquitous vulnerability for attackers.
What is the impact? From our investigation no impact to our platform has been identified. Merchants and partners are strongly encouraged to assess their own environments for this vulnerability and remediate immediately.
Who is impacted? Versions of Log4j2 from 2.0-beta9 to 2.15.0, excluding 2.12.2 are affected by this vulnerability. An extensive list of responses from impacted organizations has been compiled here for greater context: https://www.bleepingcomputer.com/news/security/log4j-list-of-vulnerable-products-and-vendor-advisories/
What action is required for BigCommerce's customers? No action is required related to your BigCommerce store. However, if you have engaged a third party development partner or leverage 3rd party applications you are strongly encouraged to request confirmation that they are not vulnerable to the Log4j vulnerability.
Note: BigCommerce will not send you any code to upload to your site or require you to install anything on your computer or in your store