Security · Lucrazo

Payments

Triple verification on every charge. The webhook token is compared using <code>hash_equals</code> (never a plain comparison), the status is re-checked directly against the gateway's API before releasing any access, and the amount received is checked against the expected purchase amount.
Resending a notification never duplicates anything. A webhook resent by the gateway — a common situation in any payment integration — is identified and handled without creating duplicate access or charges.
Refunds only revoke access when actually confirmed. A refund request, by itself, does not take access away from anyone — that only happens when the refund is actually completed.

Passwords are never reversible. Stored with bcrypt — not even Lucrazo itself can "see" anyone's password.
Session protected against hijacking. Cookie with <code>httponly</code> and <code>secure</code>, and the session identifier is rotated on every login (protection against session fixation).
Ownership verified on every action. Editing a product, viewing a purchase or approving a commission always checks that the requester is the real owner of that resource — never trusting just an identifier coming from the form.
Event records and logs without sensitive data. What is recorded internally is what's needed for auditing, not personal information beyond that.

Server access only by key. Password login is disabled — no exception.
Database never publicly exposed. Only listens on the internal network, behind a firewall with a default-deny policy.
Daily backup outside the main server. And the restore has actually been tested — it's not a backup that only exists until it's needed.

Recurring reviews, not just once. Authentication, authorization, the database and the main known attack vectors are reviewed continuously, not in a single launch-time audit.
A real finding becomes a validated fix. When a review finds an issue, the fix is tested against the real scenario before moving on — it's never marked resolved without confirmation.