Theme security and platform boundaries

A theme is untrusted presentation code. It receives only documented public data and actions.

Never:

  • import a private @upstorr/* package;
  • call Upstorr with fetch, Axios or XMLHttpRequest;
  • read or write platform cookies;
  • construct auth or CSRF headers;
  • store platform truth in local storage;
  • import Node, server or Next.js internals;
  • inject payment-provider scripts;
  • calculate GST, shipping, discounts or order totals;
  • hand-write private runtime attributes in TypeScript.

Use @upstorr/theme-sdk/v1. Storefront authentication uses secure httpOnly cookies and platform-owned CSRF handling.

Third-party browser libraries may provide presentation effects, but they must be declared dependencies and must not receive protected customer or checkout data unless the documented platform contract explicitly allows it.

Run theme check before every upload. A missing public capability must be added to the shared contract instead of being bypassed inside one theme.