Security & vulnerability reporting

Current practices

• We recommend HTTPS (e.g. Let’s Encrypt) to encrypt traffic in transit.
• Admin areas require sign-in; sensitive APIs check session or API keys.
• Image uploads verify real MIME types and stay under a controlled uploads directory.
• Card payments (when enabled) go through third-party providers (e.g. PayPal); card numbers are not stored on this server.
• Agent / Migration APIs use Bearer or X-Api-Key — not API keys in query strings.

Report a vulnerability

If you find a vulnerability, contact us privately first (please do not disclose publicly before we can respond). Include clear reproduction steps, impact, and a safe proof of concept.

Scope

In scope: this web application, this site’s public APIs, form submissions, and payments integrated on this domain.

Out of scope: DoS/DDoS, social engineering of staff, aggressive automated scanning, or issues on third-party services outside our control.

Data

The site may store order data, contact form submissions, and admin accounts on your hosting. Order/support magic links are secrets — do not share them publicly.