Security

Security is built in, not bolted on.

We integrate security into every stage of development. Here is how we protect your data, your users, and your applications.

Practices

Our security approach.

Secure Authentication

Passwords are hashed using bcrypt with unique salts. Sessions use httpOnly, secure cookies with JWT tokens. API endpoints require valid authentication by default.

HTTPS Everywhere

All traffic is encrypted in transit using TLS. HTTP requests are redirected to HTTPS. HSTS headers are set to prevent protocol downgrade attacks.

Input Validation

All user inputs are validated and sanitized using Zod schemas. SQL injection is prevented through Prisma parameterized queries. XSS protection is applied on all rendered output.

Access Controls

Role-based access control (RBAC) is enforced on all server-side operations. Users can only access their own data. Admin functionality is strictly separated from client interfaces.

Audit Logging

All sensitive operations are logged with actor identity, action type, timestamp, and state changes. Logs are immutable and retained for compliance purposes.

Regular Updates

Dependencies are monitored for vulnerabilities using automated tooling. Security patches are applied promptly. Major versions are evaluated and updated as part of maintenance.

Data Protection

Sensitive data is encrypted at rest. Payment card details are never stored on our servers — all payment processing is handled by PCI-compliant third-party gateways.

Privacy by Design

We collect only the data necessary to provide our services. Privacy considerations are integrated into architecture decisions, not added as an afterthought.

Disclosure

Responsible disclosure.

We take security seriously. If you believe you have found a security vulnerability in any of our systems, please report it to us immediately.

Email: support@viannn.online

Response time: Within 24 hours

We do not currently maintain a bug bounty program, but we gratefully acknowledge responsible disclosures in our security changelog. Please refrain from publicly disclosing vulnerabilities before we have had a reasonable opportunity to address them.