Projects / Medusa

Medusa + minidauth a store whose database can't be read

A commerce database is the classic breach: it knows who your customers are, where they live and how to reach them. In this fork of Medusa, the open source Shopify alternative, that personal data is sealed before it reaches Postgres and opens again in-request only for a staff member a quorum granted the reading role.

Open the fork Upstream Medusa

Run end to end

What gets sealed

Medusa is the open source Shopify alternative. These fields are stored as ciphertext, and nothing on the server can decrypt them.

Customers
First and last name, phone, company.
Addresses
Name, phone, company, and the street lines, on customer and order addresses alike.

How it's wired

  1. Sealed on write

    One hook on Medusa's MikroORM base repository seals the chosen fields on create and update, so every module that stores them inherits it, and ciphertext is what reaches Postgres.

  2. Opened per user

    The same base repository opens the fields when it serialises a read, for the staff member the HTTP layer verified for that request.

  3. Gated by a quorum role

    A field opens only if minidauth's quorum grant says that staff member holds the reading role. A staff member without it gets ciphertext, and revoking it makes the same query go dark.

The key that seals these fields exists only as shares across the Tide network, and 14 of 20 nodes have to cooperate to use it. It is never on the Medusa server.

Details that matter

  • The sidecar holds no reading identity of its own. Opening is delegated per staff member and gated on a quorum-granted role.
  • With no reader in the request, a field simply stays sealed, so there's never an open decryption service to abuse.
  • Every inbound value is sealed, so plaintext never reaches a sealed column.

Status and running it

A proof of concept, off unless MINIDAUTH_SEAL_URL is set, so an unconfigured checkout behaves exactly like upstream Medusa. The fork's README covers setup against a running minidauth.

Want to do the same for another app, or stuck running this one? Join the Discord and I'll help you out.

Other projects: Formbricks · Twenty · Cal.diy · Documenso · Rocket.Chat · Chatwoot · Firefly III · Integrations