Security is a core pillar of SparkleCharge. Every layer of sparklecharge.org and the SparkleCharge Client Portal is engineered with defense-in-depth controls to protect client data and system integrity.
1. Platform Security Architecture
- Parameterized Database Queries: 100% of SQL operations use PDO prepared statements with bound parameters to eliminate SQL injection vectors.
- Output Encoding & XSS Prevention: Context-aware HTML escaping and strict Content-Type headers protect against Cross-Site Scripting (XSS).
- CSRF & Session Isolation: All state-changing POST requests require cryptographic CSRF tokens, and Administrator and Client Portal sessions are strictly isolated.
- Cryptographic Document Verification: Official SparkleCharge invoices, receipts, and letters include verifiable cryptographic signatures and QR verification codes at
/verify/{code}.
2. Responsible Vulnerability Disclosure Policy
We welcome reports from independent security researchers. If you believe you have discovered a security vulnerability on sparklecharge.org, please report it responsibly:
- Email your findings to [email protected] with clear steps to reproduce the issue.
- Do not access, modify, or exfiltrate data belonging to other users or clients.
- Do not perform denial-of-service (DoS/DDoS) attacks or automated high-volume scanning that degrades service availability.
- Allow us a reasonable window to investigate and remediate the issue before any public disclosure.