If you discover a security vulnerability within this project, please send an email to bahadhay7@gmail.com. All security vulnerabilities will be promptly addressed.

This project uses sensitive configuration files that should NEVER be committed to Git:

• backend/mail.config.php - Email/SMTP credentials
• backend/config/dbcon.php - Database credentials

Setup Instructions:

1. Copy backend/mail.config.example.php to backend/mail.config.php
2. Update backend/mail.config.php with your actual credentials
3. NEVER commit backend/mail.config.php to Git

For Gmail users:

• Use App Passwords instead of your actual password
• Enable 2-Factor Authentication
• Create App Password: https://support.google.com/accounts/answer/185833

• Change default database credentials
• Use strong passwords
• Never commit database credentials to Git
• Use prepared statements to prevent SQL injection

• Enable HTTPS/SSL
• Change all default credentials
• Use environment variables for sensitive data
• Disable error display (display_errors = Off)
• Enable error logging
• Regular security updates

April 9, 2026: SMTP credentials were accidentally exposed in commit history.

• Action Taken: Credentials rotated, .gitignore updated
• Recommendation: All users should change their email passwords

• Email credentials changed from defaults
• Database credentials changed from defaults
• 2FA enabled on email accounts
• Using App Passwords for Gmail
• HTTPS enabled in production
• Error logging enabled
• Input validation implemented
• SQL injection prevention (prepared statements)
• Regular backups configured