Security Policy

Responsible disclosure

If you discover a security vulnerability, please report it to security@growzylabs.in with details and reproduction steps. We ask that you give us a reasonable window to respond before public disclosure.

What we do

• Parameterized database queries; no raw SQL interpolation.
• bcrypt password hashing; AES-256-GCM encryption for secrets at rest.
• CSRF tokens, output escaping and strict Content-Security-Policy headers.
• HMAC-SHA256 API authentication with replay protection and idempotency.
• Row-level locking and database transactions for all financial operations.
• Immutable double-entry ledger and admin audit logs.