The latest version of PaySphere is actively maintained and receives security updates.
| Version | Supported |
|---|---|
| Latest | ✅ Yes |
| Older versions | ❌ No |
The security of PaySphere is important to us. If you discover a security vulnerability, please report it responsibly.
Please do not create a public GitHub issue for security vulnerabilities.
Instead, contact the project maintainers with:
- A detailed description of the vulnerability.
- Steps to reproduce the issue.
- The potential impact.
- Any suggested fix (if available).
After receiving a vulnerability report, we will:
- Acknowledge receipt of the report.
- Investigate the issue.
- Validate the vulnerability.
- Develop and test a fix.
- Release a security update if necessary.
- Notify the reporter once the issue has been resolved.
This policy applies to all components of the project, including:
- Frontend (React + Vite)
- Backend (Node.js + Express)
- MongoDB database integration
- Authentication and authorization
- API endpoints
- File upload functionality
- CSV import/export
- PDF and Excel generation
- Email services
- Background jobs
- Redis caching
Developers and contributors should:
- Keep dependencies up to date.
- Never commit secrets, passwords, API keys, or
.envfiles. - Validate and sanitize all user input.
- Follow secure authentication and authorization practices.
- Use HTTPS in production.
- Apply the principle of least privilege.
- Regularly review third-party packages for vulnerabilities.
Do not include any of the following in bug reports or pull requests:
- Passwords
- JWT secrets
- Google OAuth credentials
- SMTP credentials
- MongoDB connection strings
- Redis connection strings
- Personal employee data
Use placeholder values when sharing configuration examples.
Please allow adequate time for the vulnerability to be investigated and resolved before publicly disclosing any security issues.
We appreciate responsible disclosure and will work to resolve confirmed vulnerabilities as quickly as possible.
We appreciate security researchers and contributors who help improve the security of PaySphere through responsible disclosure.