Security & Responsible Disclosure

1. Our practices

We use HTTPS, authenticated sessions, permission checks, payment webhooks with signature verification, and least-privilege operational access where practical. Buyers are responsible for securing their own Runtime deployments.

2. Defense in depth

• Password hashing through the application framework; plaintext passwords are not intentionally stored.
• CSRF protections for state-changing browser requests.
• React output escaping, validation, and security headers where configured to reduce XSS risk.
• Laravel query builders, parameter binding, validation, and authorization to reduce SQL injection risk.
• Signature verification for Stripe and Razorpay payment webhooks.
• HTTPS for the operated store and portal, with buyers responsible for HTTPS on their deployments.
• Framework and dependency updates reviewed through the Runtime release process.
• Least-privilege operational access plus server-side authorization and tenant-scoped checks.
• Short-lived download links and authenticated portal access for licensed artifacts.

3. Reporting

Security contact: support@saasos.app. Send responsible-disclosure reports with the affected URL, impact, reproduction steps, and supporting evidence. Please do not publicly disclose until we confirm a fix or mutually agree on a timeline. Do not access other customers' data, destroy data, or disrupt the service while testing.

4. Scope and safe harbor

In-scope: the SaaSOS marketing site and customer portal operated by us. Out of scope: third-party processors, buyer-hosted deployments, and social-engineering of individuals.

We will not pursue legal action against good-faith research that avoids privacy violations, data destruction, service disruption, extortion, and public disclosure before a reasonable remediation opportunity. This statement does not authorize access to another person's data.

5. Buyer deployment responsibility

Runtime source includes security-oriented foundations, not a guarantee of security for modified deployments. Buyers must configure HTTPS, secrets, permissions, storage, queues, backups, monitoring, patching, and incident response for their own environment.