Security Overview
How the DriveDiggers customer portal is protected. Last updated 4 August 2026.
Account security
Passwords are stored using PHP's secure password-hashing API, sessions remain server-side, session identifiers change after login, and state-changing requests require CSRF tokens.
Access control
Customer and administrator APIs are protected by role checks. Customer recovery-case queries are scoped to the authenticated customer.
Database controls
The MySQL schema uses constrained relationships and prepared queries. The runtime database account should receive only the privileges the application needs.
Operational protection
The application includes login lockout, endpoint rate limits, security headers, audit events, a minimal health check and production configuration kept outside public web access.
Responsible disclosure
Security concerns can be reported privately to recovery@drivediggers.com. Do not include customer data or credentials in an initial report.