Company

Public Security Posture (PSP)

Effective 2026-09-20 · Updated 2026-09-20 · Version 1.0.0

Change Log

  • [Version 1.0.0] (2026-09-20): Initial 3shots release adapted from the FantasyPilot LLC policies and rewritten for listing photos, Browser Helper token isolation, Amazon Bedrock vision, and ThreeShots AWS accounts.

At FantasyPilot LLC, operating 3shots, maintaining the confidentiality, integrity, and availability of your account data, listing photos, and buyer messages is foundational to our engineering standards. This Public Security Posture ("PSP") outlines the technical controls, architectural safety measures, and vulnerability disclosure policies we implement. This document describes high-level posture only; it is not a SOC 2 report or a penetration-test attestation.

1. Network & Cloud Infrastructure Architecture

3shots is hosted on Amazon Web Services (AWS) in product-owned accounts and deployed via SST:

  • Virtual Private Cloud (VPC) Isolation: Remote-stage backend compute and databases run inside an AWS VPC with multi-AZ networking.
  • Private Subnet Databases: Core PostgreSQL (AWS Aurora) for remote stages sits in private VPC subnets without public database endpoints.
  • Secure Administrative Access: Direct public SSH to databases is disabled. Administrative access uses IAM-authenticated private networking patterns consistent with AWS Systems Manager style session access used across FantasyPilot LLC products.
  • Object Storage: Item photos are stored in a dedicated S3 bucket provisioned for the product, with encryption at rest.
  • Account Isolation: ThreeShots staging and production run in ThreeShots AWS member accounts, separate from FantasyPilot product accounts.

2. Cryptographic Controls & Data Storage

  • Encryption in Transit: Public traffic to the marketing site, app, and APIs uses TLS 1.3 / HTTPS. Unencrypted HTTP is redirected or blocked at the edge.
  • Encryption at Rest: Database volumes, backups, and the item-photos bucket use industry-standard AES-256 encryption managed via AWS.
  • Clerk Identity Provider: We do not store user passwords on 3shots infrastructure. Authentication, credential storage, MFA (when enabled by the user in Clerk), and session issuance are delegated to Clerk.

3. Browser Helper Sandboxing & Local Security

The official 3shots Browser Helper is designed with least privilege:

  • Minimal Host Scope: Permissions are limited to Facebook, Nextdoor, OfferUp, and 3shots app origins required for marketplace session handling and authenticated API calls. The helper does not monitor general web history.
  • Marketplace Tokens Never Reach AWS: Facebook, Nextdoor, and OfferUp session tokens remain in chrome.storage.local and are never posted to 3shots servers, S3, or Bedrock.
  • Clerk JWT Only: The Clerk token is the only credential the helper may send to 3shots APIs.
  • Session Presence, Not Secrets: Status endpoints report marketplace session presence (in / out), not raw token values.
  • No Autofill / Password Access: The helper does not read browser password managers or payment autofill profiles.

4. AI Security & Data Leakage Prevention (DLP)

  • Vision Payload Discipline: Bedrock identification receives item photos and a structured prompt. Email addresses, street addresses, Venmo/Zelle handles, and marketplace tokens are not intentionally included in model prompts.
  • AWS Bedrock: Inference runs through Amazon Bedrock (amazon.nova-lite-v1:0) under AWS account IAM permissions (bedrock:InvokeModel), subject to Amazon’s applicable service terms.
  • No Credential Training: Marketplace tokens and Clerk JWTs are not used as training data for foundation models.
  • Output Handling: Model JSON is parsed on the backend before listing fields are persisted or shown in the UI.

5. Application Security Practices

  • Engineering aligns with OWASP Top 10 and OWASP LLM Top 10 awareness (injection, insecure output handling, excessive agency via the helper).
  • Seller and public-track routes are separated; reserved marketing paths cannot be claimed as buyer slugs.
  • We do not claim SOC 2 certification in this posture.

6. Vulnerability Disclosure Policy (VDP) & Ethical Research

We welcome ethical security researchers to evaluate our public-facing platforms and Browser Helper endpoints. If you discover a potential vulnerability, please report it.

A. Reporting Guidelines

  • Submit detailed, reproducible vulnerability reports to: hello@threeshots.ai (subject line preferred: Security vulnerability).
  • Do not attempt to access, modify, or exfiltrate other users’ listings, photos, buyer messages, or accounts.
  • Do not conduct denial-of-service (DoS) attacks, destructive data deletion, or automated spam against marketplaces.
  • Provide a reasonable window of ninety (90) days to remediate before public disclosure.

B. Safe Harbor Commitment

If you conduct your security research in accordance with these guidelines:

  • We commit to not pursuing civil litigation or law enforcement referral for that research.
  • We will collaborate to understand and remediate the issue.
  • We will provide public attribution on request once the issue is resolved.

Disclaimer: This is an AI-generated draft policy for informational purposes only. It does not constitute legal advice. Please consult with a qualified attorney before deploying to production.