Enterprise Security Architecture & Vulnerability Disclosure Policy
At ImranOnline, security is built into our core architectural DNA. We maintain rigorous defense-in-depth measures across all backend systems, public endpoints, and background automation pipelines.
1. Architectural Security Safeguards:
- Transport Layer Encryption: Forced TLS 1.3 encryption with strict HTTP Strict Transport Security (HSTS) headers.
- Defense-in-Depth HTTP Headers: Comprehensive Content Security Policy (CSP), X-Frame-Options (DENY), X-Content-Type-Options (nosniff), and Referrer-Policy.
- Input Validation & Injection Defense: 100% prepared SQL statements, dual sliding-window rate limiting, and multi-layer input sanitization.
- Cryptographic Storage: Passwords hashed using standard PHP
password_hash()algorithms, and sensitive tokens encrypted with AES-256-GCM.
2. Responsible Vulnerability Disclosure Program:
We welcome and value reports from ethical security researchers. If you discover a potential vulnerability, please follow our safe harbor guidelines:
- Email full reproduction steps, payload details, and impact analysis to imran@haitechnologies.com.
- Allow us reasonable time (up to 30 days) to remediate the issue prior to any public disclosure.
- Do not exploit the vulnerability beyond proof of concept, access or modify customer data, or disrupt production availability (e.g., avoid DDoS or volumetric attacks).
3. Safe Harbor Commitment:
If you conduct security research in good faith and comply with these responsible disclosure principles, we will not pursue legal action against you and will acknowledge your contribution.