We take the security of the Fuel Pump Management System (FPMS) seriously. If you discover a security vulnerability, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

Instead, please email hello@kodlyft.com with:

• A description of the vulnerability
• Steps to reproduce the issue
• The potential impact
• Any suggested fix (if you have one)

• Acknowledgment: We will acknowledge receipt of your report within 48 hours.
• Assessment: We will assess the severity and impact within 5 business days.
• Resolution: We aim to release a fix within 30 days of confirmation, depending on complexity.
• Credit: We will credit you in the release notes (unless you prefer to remain anonymous).

The following are in scope:

• The FPMS application code (Python backend, doctype controllers, whitelisted APIs)
• Authentication and authorization logic (roles, permissions)
• Data handling and storage (wet-stock, pricing, financial postings)
• API endpoints exposed by the app

The following are out of scope:

• Vulnerabilities in Frappe Framework or ERPNext (report these to their respective projects)
• Issues in third-party dependencies (report upstream, but let us know so we can update)
• Social engineering attacks
• Denial of service attacks

• Always run FPMS behind HTTPS
• Keep Frappe, ERPNext, and FPMS updated to the latest versions
• Use strong passwords and enable two-factor authentication
• Restrict FPMS Manager / Cashier / Operator roles to authorized users only
• Review user permissions regularly