Security Policy

Confrig uses layered application safeguards appropriate to the service and its risks. These controls reduce risk but do not make any internet-connected service immune from attack, interruption, or data loss.

Protected application routes require authenticated sessions and authorization checks. Server APIs validate request input, restrict returned data, and keep credentials and integration secrets out of browser code.

Network requests use TLS. Vercel terminates TLS 1.3 (and TLS 1.2) at the platform edge; application code cannot select the TLS version. Responses send HTTP Strict Transport Security with includeSubDomains. Passwords use bcrypt. Webhook signatures use HMAC-SHA256. Fingerprints and audit IP hashes use SHA-256. Session cookies are HttpOnly, Secure on HTTPS, and SameSite=Lax.

QR Ph checkout is created by the server from a validated plan, PHP amount, and billing interval. Browser-provided prices are not accepted as authoritative.

Plan access is activated only after a successful payment is independently verified. Signed payment notifications, transaction references, amount and currency checks, and replay controls help prevent forged or duplicate activation.

We apply least-necessary data access, retain operational records for security and support, review dependencies and application code, and update safeguards as threats and the service evolve.

Backups, third-party availability, and incident recovery may have practical limits. If a security incident affects personal data, we investigate, contain, and notify affected people or authorities when required by applicable law.

The public website and the admin console can run on separate origins of the same application. Admin UI and /api/admin are served on the admin origin. Website visitors who open /admin are sent to that origin. Session cookies stay host-only with SameSite=Lax. If the two hosts share a parent domain, they are same-site. If they are unrelated domains, sign in on the admin origin; website cookies are not sent there.

Report suspected vulnerabilities or security concerns to illuminarypeak@gmail.com. Please avoid accessing other users' data, disrupting the service, or publicly disclosing an unresolved issue before we can investigate.