Support

What this project is and is not, what you can check before spending anything, the recovery path for the one thing that can go wrong after you pay, and two ways to reach a person.

Where this project is

HonorBox is an independent, MIT-licensed project, and it is new. The first commit is dated 18 July 2026. It has not been through a real-world week yet, let alone a quarter, and nothing on this page is going to argue otherwise. If you are weighing $29 against that, the honest framing is that you are not buying a track record, because there is not one to buy.

What exists instead of age is a public record. Every change ships as a tagged release with notes that name the limits as well as the features, and the release history is that record, dates included. Read the notes rather than the version numbers.

The parts you build a store on top of, store.config.json, the product frontmatter, and the fulfillment grant format, are stable. Breaking changes to those only land in a major version, and always with an upgrade note.

What you can check before you pay

Trust is normally bought with age, and this project has none to spend. These are the substitutes. Every one of them is something you verify yourself rather than something we assert.

• The code that would take your buyer's money. scripts/fulfill.js is the whole fulfillment path: it polls Stripe, matches the order to a grant, and invites the buyer. No dependencies, no framework, readable in one sitting.
• This page is built by the product. The store you are standing in is generated by the engine it sells, from store.config.json in the public repository. The demo and the product are the same artifact, which is easy to claim and awkward to fake.
• The tests, on your machine rather than ours. Clone the repository and run npm test. It needs Node, no network, no key and no account. Anything guarding money or access is mutation checked: the guard is broken on purpose and the test has to go red first, because a test that cannot fail proves nothing.
• Every host the engine talks to. api.stripe.com and api.github.com. There is no third one. grep -rn "fetch(" scripts/ webhook-mode/ is the entire audit: no telemetry, no license server that can be switched off, and no analytics script anywhere on the storefront.

If this project stops

The fair question about something this young is not whether it is good today. It is what you are left holding if it is abandoned. That has a real answer here, and the answer comes from how the thing is built rather than from a promise anyone makes.

• The free engine is MIT-licensed, and MIT cannot be withdrawn, not by a later owner and not by us.
• Nothing of ours sits in the path of a sale. Your storefront is your own GitHub Pages site, your checkout is your own Stripe account, and your fulfillment is a GitHub Action in your own repository. If this project went silent tonight, every store built on it would take money and deliver tomorrow, because there is no server of ours to switch off.
• What you buy is a repository you keep. Paid delivery is a private repo invitation, so the code lands in your GitHub account and stays there. It does not check a licence, phone home, or expire.
• What you would actually lose is future updates. Past that it is the same position as any unmaintained MIT project: you hold the source, and you can fix it or fork it.

None of that is an argument that this project will last. It is the reason you do not have to bet on it lasting.

What HonorBox does not do

Worth knowing before you commit, not after.

• It is not a merchant of record. You sell on your own Stripe account, so sales tax and VAT obligations are yours, not a platform's. The tax guide covers what a small seller actually owes.
• Your buyers need GitHub accounts. Delivery is an invitation to a private repository. That is the right channel for code, templates, tools and developer courses, and the wrong one for lay-reader ebooks, physical goods, or a general consumer audience.
• There is no instant download link. Delivery is repo access, granted by a scheduled job, usually within minutes. Sellers who need seconds can turn on webhook mode. A download URL is instant, and then uncontrollable.
• There is no hosted checkout to configure. Checkout is a Stripe Payment Link on Stripe's own page. Nothing about the payment form is ours to style or to break.
• There is no dashboard and no account. The storefront is static files on GitHub Pages. Nothing to log into, and nothing collecting data on your visitors.

If a delivery does not arrive

The invitation is the delivery, so this is the failure that matters. It has a defined path rather than a hope.

1. Check the email GitHub sent, including spam. The invitation goes to the address on your GitHub account, not necessarily the one you paid with.
2. A mistyped username is caught, not lost. The order is flagged for a human, and your checkout email is on the order, so it can be corrected by hand.
3. An unopened invitation is re-sent. GitHub expires an unaccepted invitation after seven days. It is renewed before that happens, up to three times, so missing one email does not cost you what you paid for.
4. After that a person is told, by name. The run stops and reports which buyer never accepted, rather than reporting success and quietly delivering nothing.

At any point in that sequence you can skip it and email, and the fix is either access or a refund. You are never left holding a receipt for nothing.

Every failure mode of the delivery pipeline, and what each one does, is written down in how it works.

Getting help

Open an issue for anything about the engine: a bug, a setup problem, a question about the code, a feature you need. Issues are the preferred channel because they are public, they are tracked, and the answer helps whoever hits the same thing next.

Email honorbox@proton.me for anything to do with your own order: a delivery that has not arrived, a refund, a billing question, or anything you would rather not discuss in public.

Both reach the same place. Neither carries a contractual response time, and this page is not going to pretend otherwise, but delivery problems and refunds are handled ahead of everything else.

Why the contact is an address and not a name

Support is an email address, and the project publishes no company name or legal identity behind it. That is a real thing to weigh rather than something to wave away, so here is what it does and does not cost you.

It does not affect your money. Checkout runs on Stripe, on your card's normal rails, so both the refund route and the chargeback route exist independently of anything written on this page, and neither one depends on us replying. What you bought lands in your own GitHub account and stays there.

It does affect escalation. There is no company to escalate to and no filing you can look up. If that is disqualifying for you, that is a reasonable place to stop, and the free core is MIT-licensed and costs nothing.

Refunds

30 days, no questions asked, on everything sold here. Repository access ends when a refund is issued. The refund policy has the detail, including what happens after 30 days.

Reporting a security problem

Email honorbox@proton.me rather than opening a public issue, so a problem that affects sellers running the engine can be fixed before it is described in public. Include what you did and what you saw. If you would like credit in the release notes, say so and you will get it.