Secure-by-design principles
The website architecture separates the corporate CMS from the live GBI Invoicing application. Corporate website database writes are limited to website-prefixed data while invoicing package information is read separately.
Application controls
Administrative actions use authenticated sessions, CSRF protection, prepared database statements, server-side validation and activity logging.
Responsible disclosure
Security concerns can be reported through the published company contact channels.