Security & Responsible Disclosure Policy
Architecture principles of multi-tenant security, Row-Level Security isolation, RBAC, and clear guidelines for ethical security researchers reporting vulnerabilities.
1. Security Architecture Principles
WSNexa implements defense-in-depth security principles engineered to protect hospitality operations, sensitive customer data, and financial transactions.
We do not make misleading claims of "100% security" or "zero risk"; rather, we maintain rigorous technical controls to detect, mitigate, and resolve vulnerabilities.
2. Technical & Organizational Safeguards
Our platform incorporates the following verified technical safeguards:
- Multi-Tenant PostgreSQL Row-Level Security (RLS): Database policies enforce strict tenant boundaries. Queries cannot access rows outside the verified tenant context.
- Role-Based Access Control (RBAC): Least-privilege role permissions ensure staff members only access capabilities required for their duties (e.g. kitchen staff cannot view cashier balances).
- Encryption in Transit: All web and API traffic is encrypted using modern TLS 1.3 / HTTPS encryption.
- Anti-Fraud Controls: Dining orders support physical GPS geofencing validation and dining table security PINs to prevent remote order tampering.
- Realtime Audit Logging: High-impact actions (refunds, cancellations, role modifications, branch creations) generate immutable audit records.
3. Responsible Disclosure Guidelines for Researchers
We welcome reports from ethical security researchers who discover vulnerabilities in WSNexa services. We ask that researchers observe the following rules:
- Do not access, modify, or download data belonging to other hospitality businesses or customers.
- Do not conduct denial-of-service (DoS/DDoS) attacks, automated stress testing, or disruption of active kitchen/cashier operations.
- Do not execute destructive attacks or alter database records.
- Give WSNexa reasonable time (at least 30 business days) to remediate the vulnerability before public disclosure.
4. How to Submit a Vulnerability Report
Submit security vulnerability reports to wsnexaofficial@gmail.com or via our dedicated Security Report Form at /security/report.
Include the following details:
- Clear vulnerability summary and severity assessment (Low, Medium, High, Critical).
- Exact URL, API endpoint, or component affected.
- Step-by-step reproduction instructions and proof of concept.
- Screenshots or sanitized log extracts demonstrating the issue.
5. Our Commitment to Researchers
WSNexa commits to acknowledging valid security reports within forty-eight (48) business hours, providing status updates during investigation, and not pursuing legal action against researchers acting in good-faith compliance with this policy.