Security & Responsible Disclosure

How Wasool protects operator data, and how to report a vulnerability.

• Isolation. Each operator's data (customers, payments, staff) is separated at the database level and scoped on every request.
• Encryption in transit. All traffic is served over HTTPS.
• Passwords. Stored using bcrypt hashing; plain passwords are never stored or logged.
• Backups. The production database is backed up nightly with encrypted off-site copies.
• Responsible disclosure. Found a security issue? Please report it privately to selvanayakiammancables@gmail.com — do not test against live customer data. We will acknowledge within 72 hours and fix confirmed issues on priority.
• Bounty. We credit researchers in release notes on request.