Security Policy

Salted scrypt password hashing, httpOnly session cookies, optional TOTP two-factor authentication with recovery codes, and Hubtel SMS verification for step-up challenges.

Role-based access control resolved server-side from the roles and permissions tables. Client-supplied roles are never trusted.

All payment state transitions are driven by server-side verification and webhooks. Duplicate webhook deliveries are idempotent. Hubtel credentials are server-side environment secrets and are never exposed to the browser.

Protected packages are served only after authentication, publication status, account status and entitlement checks, with rate limiting and full audit logging. Only short-lived signed references are issued.

Input validation with strict schemas, output escaping, CSRF-protected server actions, security headers, file-type and size validation, malware scanning workflow for uploads and rate limiting on sensitive endpoints.