Over the past few days, Sellinn was targeted by a spam bot — the same kind of bad actor that shows up on every marketplace that starts gaining traction. We won't pretend it wasn't annoying. Some of you received messages with suspicious links, and a wave of email notifications went out that shouldn't have. We're sorry for the noise.
Here's what actually happened, and what we did about it.
The attack was automated — a bot creating accounts and sending phishing messages across listings, trying to redirect sellers to fake "payout verification" sites. Classic marketplace scam, and unfortunately a sign that Sellinn is now worth targeting. We took it as a challenge.
Within hours of the attack, we deployed three layers of protection directly into the database:
— External links in chat messages are now blocked entirely at the database level. No matter how a message is sent — through the app, through a modified client, directly through the API — if it contains a link to an outside site, it never reaches the DB. It's not filtered. It's rejected.
— Rate limits now cap how many messages any single user can send within a given window. Bots that try to flood conversations hit a wall fast.
— Additional protections now cover other vectors the bot attempted to exploit. Those gaps are closed.
These protections sit below the app layer. They can't be bypassed by a modified browser or a direct API call. We also cleaned up the bot accounts, removed their messages, and are reviewing our sign-up flow.
On the email side: some of you received a flood of "your listing is getting attention" emails. That was a separate issue — a background job that sends seller notifications had been misconfigured since April and fired for the first time properly this week. It sent every backlogged notification at once. We've fixed the configuration and it won't repeat.
None of this affected any payments, listings, or personal data. Sellinn doesn't store card details — Stripe handles payments, and the attack never touched that layer.
A few things we want to say directly:
Thank you to everyone who reported suspicious messages. It helps more than you know, and action is taken almost immediately when you do. You can always report a user from their profile or flag a message in chat.
Thank you for being on Sellinn. We're still a small platform run lean and built carefully, and we're determined to keep it that way. Every time something like this happens, the platform gets a little harder to abuse and a little safer for the people who use it genuinely.
If you enjoy using Sellinn or have made a sale here, we'd love your support. We keep the marketplace free — no seller fees, no buyer charges — and we intend to keep it that way. If you want to help us do that, head back to the homepage — you'll find the Support Sellinn option in the footer. It's entirely optional, and we're grateful either way.
We're not going anywhere. Neither are you. 🍀