ondc-buyer
Facilitates deployment and management of ONDC buyer applications, enabling seamless product discovery and order tracking in India.
Install this skill
Security score
The ondc-buyer skill was audited on Jun 8, 2026 and we found 29 security issues across 3 threat categories, including 2 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Webhook reference - potential data exfiltration
| 186 | JUSPAY_WEBHOOK_USERNAME="webhook_user" |
Webhook reference - potential data exfiltration
| 187 | JUSPAY_WEBHOOK_PASSWORD="webhook_pass" |
Webhook reference - potential data exfiltration
| 239 | 5. Set up webhook endpoints for payment callbacks |
Webhook reference - potential data exfiltration
| 305 | - Check webhook configuration |
Webhook reference - potential data exfiltration
| 322 | - Validate payment webhook signatures |
Ngrok tunnel reference
| 41 | 3. **Domain name** or ngrok for public endpoint |
Ngrok tunnel reference
| 328 | ### Local Development (with ngrok) |
Ngrok tunnel reference
| 331 | # Install ngrok |
Ngrok tunnel reference
| 332 | brew install --cask ngrok |
Ngrok tunnel reference
| 335 | ngrok http 5555 |
Ngrok tunnel reference
| 337 | # Use ngrok URL in BAP_URL and PROTOCOL_BASE_URL |
Access to .env file
| 83 | docker-compose -f docker-compose-for-local.yaml --env-file .env-local up -d |
Access to .env file
| 319 | - Never commit `.env` files or credentials to version control |
Access to .env file
| 344 | docker-compose -f docker-compose.yaml --env-file .env-prod up -d |
External URL reference
| 73 | --domain "https://buyerapp.example.com" \ |
External URL reference
| 86 | Access the app at `http://localhost` (or your configured domain). |
External URL reference
| 94 | --subscriber-url "https://buyerapp.example.com" \ |
External URL reference
| 170 | BAP_URL="https://buyerapp.example.com" |
External URL reference
| 183 | JUSPAY_BASE_URL="https://sandbox.juspay.in" |
External URL reference
| 193 | REACT_APP_PAYMENT_SERVICE_URL="https://api.juspay.in" |
External URL reference
| 235 | 1. Create account at https://dashboard.juspay.in |
External URL reference
| 261 | - `https://outpost.mapmyindia.com/api` - Authentication |
External URL reference
| 262 | - `https://atlas.mapmyindia.com/api/places/search/json` - Search |
External URL reference
| 263 | - `https://explore.mappls.com` - Explore places |
External URL reference
| 264 | - `https://apis.mapmyindia.com/advancedmaps/v1` - Advanced mapping |
External URL reference
| 265 | - `https://atlas.mappls.com/api/places/geocode` - Geocoding |
External URL reference
| 271 | 1. After deployment, visit `https://yourdomain.com/bugzilla/admin` |
External URL reference
| 371 | - ONDC Slack: https://witsinnovationlab.slack.com/archives/C0280AR5CUQ |
External URL reference
| 372 | - Registry Form: https://forms.gle/registrationform |