Script catalog

The application never stores, logs or handles primary account numbers or CVV; payments go through a gateway with tokens only.

Message content is encrypted on the client with a recognised protocol; the server never sees plaintext or logs messages.

Everything is served over TLS 1.2 or later with HSTS, no mixed content, hardened cookie flags and no sensitive data in URLs.

No endpoint exposes personal data without authentication or authorisation; errors, pagination, rate limits and CORS are closed.

Personal data collected matches its declared use, never leaks to logs or third parties, and has a declared retention with real deletion.

Passwords are hashed with a slow algorithm, sessions expire and rotate, 2FA is available, tokens are stored with reason, and reset flows cannot be abused.

No committed credentials, locked and vulnerability-free dependencies, licence compliance, pinned builds and two model-assisted reviews.

Everything in Payments plus multi-gateway handling, reconciliation integrity and the wider PCI DSS scope (segmentation, key management, logging).

Everything in API plus OpenAPI contract conformance, authentication fuzzing and multi-tenant isolation.

Everything in Data minimisation plus a full PII map per table, third-party data flows and retention per store.

Everything in Chat E2EE plus group chat and multi-device key management and forward secrecy.