Security & Responsible Disclosure

1. Security is a product responsibility

BILLI PRO treats security as an ongoing engineering and operational responsibility. Controls are designed to protect accounts, invoices, financial records, customer data and administrative functions against common application and operational threats.

2. Current safeguards

• Server-side authentication and authorisation checks.
• Session timeout and session/security validation.
• CSRF protections for state-changing actions.
• Prepared database operations and server-side validation.
• Password hashing rather than plaintext password storage.
• Security headers and protected private application/storage areas.
• Rate limiting and controlled handling of sensitive public invoice access.
• Structured security logging and operational error handling.
• Financial transactions protected with validation, locking and one-time action tokens where appropriate.

3. Responsible disclosure

If you believe you have found a vulnerability, report it privately to security@billi.indiastudios.in. Provide the affected page/function, reproduction steps and safe evidence. Do not access data that does not belong to you, modify another user's records, disrupt service or publicly disclose the issue before reasonable investigation.

4. Incident response

When a credible incident is identified, BILLI PRO will assess severity, contain the issue, preserve relevant evidence, remediate where possible and make legally required notifications. Indian cyber-incident obligations may require reporting to CERT-In within prescribed timelines for covered incidents.

5. Third-party payment security

Where card or other payment processing is handled by a specialised payment provider, BILLI PRO aims to minimise direct exposure to payment credentials. Responsibilities remain subject to the selected integration and applicable payment-security requirements.

6. Security limitations

No software service is immune from attack. Security controls reduce risk but cannot guarantee that every future vulnerability or third-party incident will be prevented.