Security
What is secure, and what is not, in the nature of extensions.
Unforgeable, in the sense that a buyer cannot make the platform think they paid. Entitlement is a server-signed token bound to one device; the private key never leaves the Wall; the extension only verifies. Every deciding request is signed by a device key that cannot be exported. The extension link is a hash server-side, bound to one install, narrow, expiring, revocable; the browser session never reaches the extension. Licence keys are stored as hashes; activation is capped per device. Trials need a verified, non-disposable address; one per account per tool.
Not preventable, in the nature of extensions. The code runs on the buyer's machine. Someone who edits the extension's own JavaScript can skip a check that happens inside the extension. What the server does — counting, tokens, downloads it authorises — is safe; a feature the extension computes locally is only as protected as any client-side software.
Your workspace. Your buyers live in a pool of their own; another workspace cannot read them. API keys are hashed and shown once; webhook secrets are Svix's; your signing key is sealed at rest and revealed only to you, in an export you asked for.
The full record of what is promised and what keeps each promise is in the Wall's SECURITY.md.