The application uses server-side validation, prepared database statements, hashed passwords, expiring tokens and role-based permissions.
Account passwords are hashed with PHP password functions and are never returned by the API. Database writes use prepared queries, uploads are checked by type and size, and administrator actions require the correct authenticated role.
Use HTTPS, strong unique credentials, environment-based secrets, supported PHP and MySQL versions, restricted file permissions, monitoring and tested off-site backups. Remove demo accounts or change every demo password before launch.
Do not enter passwords, OTPs, card numbers, bank-account credentials, PAN details or full financial statements into public calculator fields or contact forms. Calculations run in the browser and do not require identity documents.
