Security & Responsible Disclosure
At AapkaLove, protecting user accounts, transaction integrity, and community data is a fundamental priority. We implement industry-standard technical measures across our application stack to ensure safe and authentic community interactions.
Technical Security Safeguards
Our platform incorporates multi-layered security controls to protect against unauthorized access, manipulation, and data exposure:
Cryptographic Password Hashing
User passwords are one-way hashed using salted Bcrypt algorithms (password_hash) with automatic legacy hash upgrades.
SQL Injection Prevention
Database operations utilize parameterized prepared statements (mysqli_stmt) across all read and write queries.
CSRF Token Verification
All critical actions (voting, account edits, points checkout, password resets) enforce per-session cryptographic CSRF tokens.
Session Hardening
Authentication cookies are issued with strict HttpOnly and SameSite=Lax flags over SSL/TLS.
Rate Limiting & Cooldowns
Authentication and OTP verification endpoints enforce strict IP and user rate limits to prevent brute-force attacks.
Responsible Vulnerability Disclosure
We welcome reports from independent security researchers and community members to help keep AapkaLove safe and secure.
Reporting Guidelines
If you believe you have discovered a potential security vulnerability, please adhere to the following protocol:
- 1 Send a detailed report with reproduction steps, sample requests, or proof-of-concept scripts to our engineering team.
- 2 Do not access, modify, download, or delete other users' private data or degrade platform availability.
- 3 Allow our security team a reasonable window of time to investigate, triage, and patch the reported issue before any public disclosure.