Security & Responsible Disclosure
Security depends on the application and how its operator deploys, monitors and maintains it.
1. Application controls
The application includes hashed passwords, email verification, signed webhook checks, tenant-scoped API access, role restrictions, CSRF checks, encrypted integration credentials, input validation, rate limits and protected receipt storage. These controls reduce risk; they are not a certification or a promise that every vulnerability has been eliminated.
2. Operator responsibilities
Use HTTPS, strong unique secrets, a supported runtime, JSON data backups, restricted hosting access, updates, monitoring and a tested recovery process. Verify provider permissions and production configurations before accepting real customers. No uptime SLA, penetration-test certification or compliance certification is implied unless separately documented.
3. Report a vulnerability
Email mushtaq@dadtechnologies.com with a description, affected URL and safe reproduction steps. Do not access other customers’ information, run destructive tests, send unsolicited messages or publish secrets. We will review reports and coordinate an appropriate response.