[{"data":1,"prerenderedAt":399},["ShallowReactive",2],{"docs-nav":3,"docs-\u002Fdocs\u002Fsecurity":35,"docs-surround-\u002Fdocs\u002Fsecurity":392},[4,9,13,18,22,26,30],{"path":5,"title":6,"category":7,"order":8},"\u002Fdocs","Introduction","intro",1,{"path":10,"title":11,"category":7,"order":12},"\u002Fdocs\u002Fgetting-started","เริ่มต้นใช้งาน",10,{"path":14,"title":15,"category":16,"order":17},"\u002Fdocs\u002Fauthentication","Authentication","core",20,{"path":19,"title":20,"category":16,"order":21},"\u002Fdocs\u002Fapi","API Reference",25,{"path":23,"title":24,"category":16,"order":25},"\u002Fdocs\u002Fwebhooks","Webhooks",30,{"path":27,"title":28,"category":16,"order":29},"\u002Fdocs\u002Fsecurity","Security & PDPA",50,{"path":31,"title":32,"category":33,"order":34},"\u002Fdocs\u002Fchangelog","Changelog","meta",90,{"id":36,"title":28,"badge":37,"body":38,"category":16,"description":384,"extension":385,"meta":386,"navigation":387,"order":29,"path":27,"seo":388,"stem":389,"updatedAt":390,"__hash__":391},"docs\u002Fdocs\u002Fsecurity.md","PDPA",{"type":39,"value":40,"toc":372},"minimark",[41,45,49,125,152,156,184,188,214,218,249,253,268,284,288,356,366,369],[42,43,44],"p",{},"SlipBolt จัดการ \"ข้อมูลการเงิน\" จึงออกแบบความปลอดภัยตั้งแต่ชั้น credential ถึงการลบข้อมูลตาม PDPA",[46,47,15],"h2",{"id":48},"authentication",[50,51,52,68],"table",{},[53,54,55],"thead",{},[56,57,58,62,65],"tr",{},[59,60,61],"th",{},"Credential",[59,63,64],{},"ใช้กับ",[59,66,67],{},"รายละเอียด",[69,70,71,101],"tbody",{},[56,72,73,80,83],{},[74,75,76],"td",{},[77,78,79],"strong",{},"JWT (HS256)",[74,81,82],{},"Dashboard \u002F LIFF",[74,84,85,86,90,91,90,94,97,98],{},"access token 15 นาที + refresh 7 วัน (rotated) · cookie ",[87,88,89],"code",{},"httpOnly"," + ",[87,92,93],{},"Secure",[87,95,96],{},"SameSite=Lax"," + path ",[87,99,100],{},"\u002Fapi",[56,102,103,108,111],{},[74,104,105],{},[77,106,107],{},"API key",[74,109,110],{},"Server-to-server",[74,112,113,116,117,120,121,124],{},[87,114,115],{},"sk_live_…"," \u002F ",[87,118,119],{},"sk_test_…"," · เก็บเป็น ",[77,122,123],{},"argon2 hash"," (โชว์เต็มครั้งเดียว) · revoke\u002Frotate ได้เอง",[126,127,128,140,146],"ul",{},[129,130,131,132,135,136,139],"li",{},"Refresh token เก็บเป็น ",[77,133,134],{},"sha256 hash"," (",[87,137,138],{},"Session.tokenHash",") — DB dump ที่หลุดไป replay ไม่ได้",[129,141,142,145],{},[77,143,144],{},"Refresh-reuse detection"," — token เก่าถูกใช้ซ้ำ → revoke ทั้ง chain ทันที",[129,147,148,151],{},[77,149,150],{},"New-device detection"," — login จากอุปกรณ์ใหม่ → แจ้งเตือนทางอีเมล",[46,153,155],{"id":154},"encryption","Encryption",[126,157,158,164,178],{},[129,159,160,163],{},[77,161,162],{},"In transit:"," TLS 1.2+ ทุก endpoint",[129,165,166,169,170,173,174,177],{},[77,167,168],{},"At rest:"," LINE channel secret\u002Ftoken เข้ารหัส ",[77,171,172],{},"AES-256-GCM"," (key ",[87,175,176],{},"ENCRYPTION_KEY"," · 32-byte hex) — ถอดเฉพาะตอนเรียก LINE API, ไม่เคย cache plaintext ลง Redis",[129,179,180,181],{},"รหัสผ่านผู้ใช้: ",[77,182,183],{},"argon2id",[46,185,187],{"id":186},"webhook-integrity","Webhook integrity",[126,189,190,196],{},[129,191,192,195],{},[77,193,194],{},"ขาเข้า (LINE):"," ตรวจ HMAC-SHA256 ของ raw body ทุก request ก่อนรับ",[129,197,198,201,202,205,206,209,210,213],{},[77,199,200],{},"ขาออก (ของคุณ):"," ทุก delivery เซ็น ",[87,203,204],{},"X-Slipbolt-Signature: t=\u003Cts>,v1=\u003Chmac>"," — ",[77,207,208],{},"verify ทุกครั้ง"," ด้วย webhook secret ของ endpoint (ดู ",[211,212,24],"a",{"href":23},")",[46,215,217],{"id":216},"rate-limit-abuse","Rate limit & abuse",[126,219,220,223,242],{},[129,221,222],{},"Global throttle 120 req\u002Fmin · login 5 req\u002Fmin",[129,224,225,226,229,230],{},"API key มี rate limit ",[77,227,228],{},"ต่อ key"," ที่ 120 req\u002Fmin (เท่ากันทุกแพ็ก · ไม่ได้ผูกกับราคา)\n",[126,231,232],{},[129,233,234,235,238,239],{},"เพดานรวมของ ",[87,236,237],{},"POST \u002Fapi\u002Fv1\u002Fverify"," ที่ 240 req\u002Fmin — ดู ",[211,240,15],{"href":241},"\u002Fdocs\u002Fauthentication#rate-limit-%E0%B9%80%E0%B8%97%E0%B9%88%E0%B8%B2%E0%B8%81%E0%B8%B1%E0%B8%99%E0%B8%97%E0%B8%B8%E0%B8%81%E0%B9%81%E0%B8%9E%E0%B9%87%E0%B8%81",[129,243,244,245,248],{},"Input: รับเฉพาะ ",[87,246,247],{},"application\u002Foctet-stream"," (raw bytes) · จำกัดขนาดรูป",[46,250,252],{"id":251},"audit-log","Audit log",[42,254,255,256,259,260,263,264,267],{},"ทุก security event (login\u002Flogout · password · session · link\u002Funlink · API key · plan · admin action) เก็บใน ",[87,257,258],{},"audit_logs"," แบบ ",[77,261,262],{},"append-only"," · ผู้ใช้ดูของตัวเองได้ที่ ",[77,265,266],{},"Settings → Audit Log"," · prune อัตโนมัติหลัง 90 วัน",[42,269,270,271,274,275,274,278,274,281,213],{},"Log ระบบ redact ค่าอ่อนไหวอัตโนมัติ (",[87,272,273],{},"password",", ",[87,276,277],{},"*token*",[87,279,280],{},"*secret*",[87,282,283],{},"Authorization",[46,285,287],{"id":286},"pdpa-สิทธิ์เจ้าของข้อมูล","PDPA — สิทธิ์เจ้าของข้อมูล",[50,289,290,300],{},[53,291,292],{},[56,293,294,297],{},[59,295,296],{},"สิทธิ์",[59,298,299],{},"ทำได้ที่",[69,301,302,315,328,342],{},[56,303,304,309],{},[74,305,306],{},[77,307,308],{},"เข้าถึง \u002F พกพา (Access · Portability)",[74,310,311,314],{},[87,312,313],{},"GET \u002Fauth\u002Fme\u002Fexport"," → JSON ทั้งหมด (ไม่มี secret) · Settings → Security",[56,316,317,322],{},[74,318,319],{},[77,320,321],{},"ลบ (Erasure)",[74,323,324,327],{},[87,325,326],{},"DELETE \u002Fauth\u002Fme"," → soft-delete + ยกเลิก subscription + revoke ทุก session · cron ลบจริงหลัง 24 ชม.",[56,329,330,335],{},[74,331,332],{},[77,333,334],{},"ความเป็นส่วนตัวของสลิป",[74,336,337,338,341],{},"รูปสลิป ",[77,339,340],{},"ลบทันทีหลังตรวจเสร็จ"," (ไม่ persist) · เก็บเฉพาะ text (ref\u002Fยอด\u002Fวันที่\u002Fชื่อ)",[56,343,344,349],{},[74,345,346],{},[77,347,348],{},"Retention",[74,350,351,352,355],{},"ข้อมูลธุรกรรม anonymize อัตโนมัติตาม ",[87,353,354],{},"pdpaRetentionMonths"," (default 12 เดือน) เมื่อร้านเปิด auto-delete",[42,357,358,359,135,362,365],{},"ข้อมูลทุกชิ้น ",[77,360,361],{},"isolated ต่อร้าน",[87,363,364],{},"shopId",") — ไม่มีการรั่วข้าม tenant",[46,367,368],{"id":368},"รายงานช่องโหว่",[42,370,371],{},"พบปัญหาความปลอดภัย ติดต่อทีมงานก่อนเปิดเผยสาธารณะ — เราจะตอบกลับและแก้ไขโดยเร็ว",{"title":373,"searchDepth":374,"depth":374,"links":375},"",3,[376,378,379,380,381,382,383],{"id":48,"depth":377,"text":15},2,{"id":154,"depth":377,"text":155},{"id":186,"depth":377,"text":187},{"id":216,"depth":377,"text":217},{"id":251,"depth":377,"text":252},{"id":286,"depth":377,"text":287},{"id":368,"depth":377,"text":368},"มาตรฐานความปลอดภัย — encryption at rest, HMAC webhook, การจัดการ key, สิทธิ์ตาม PDPA","md",{},true,{"title":28,"description":384},"docs\u002Fsecurity",null,"d84KxKzUEHXNKKcw65tgv2MnoksRCMjIBq6nuBgAurc",[393,396],{"title":11,"path":10,"stem":394,"description":395,"children":-1},"docs\u002Fgetting-started","ตรวจสลิปแรกของคุณภายใน 5 นาที — ตั้งร้าน, ผูก LINE, เช็คโควตา, ยิง API (Starter ขึ้นไป)",{"title":24,"path":23,"stem":397,"description":398,"children":-1},"docs\u002Fwebhooks","รับ event แบบ HMAC-signed · retry อัตโนมัติ 5 ครั้ง · delivery log + auto-disable endpoint ที่ล่ม",1789321305994]