Security

Security

Threat	Defense
SQL injection	Prepared statements on every request-derived value, int casts, enum allowlists
XSS	Output escaping everywhere. Storefront CSP is nonce-only (script-src 'self' 'nonce-…', fresh per request, no unsafe-inline)
CSRF	Per-session tokens on every form and state-changing API
Brute force / abuse	Per-scope rate limits with progressive blocking and layered CAPTCHA (reCAPTCHA v3 → v2 → fallback) with a honeypot
DoS / DDoS	App-level throttling plus TraceEnable Off. Put Cloudflare (or similar) in front of production for volumetric attacks
Race conditions	Transactions, SELECT … FOR UPDATE, conditional stock decrements, idempotency keys, ON DUPLICATE KEY upserts
Malicious uploads	MIME/extension checks, signature scan (PHP tags, eval, <script>, …), re-encoding to WebP, optional ClamAV, fail-closed mode
Credential theft	Argon2id hashing (bcrypt-12 fallback), strict password policy, email 2FA on every admin login
Info leakage	Internal folders denied by .htaccess, clean 503 on DB failure, expose_php=Off

Verified: scripts/security/security_probe.php 33 / 33 PASS and security_smoke_tests.ps1 8 / 8 PASS, both run in CI on every push.

Report vulnerabilities privately via Security Advisories or support@ahmershah.dev.