Security & Support

How the module stays safe and where to get help.

Security model

• Server-side access control — every page and endpoint repeats the WHMCS Access Control check; denied admins get a permission error, not data.
• Never fatal — hooks, endpoints and cron code run inside try/catch, and errors return a generic message instead of a stack trace.
• CSRF tokens — every state-changing action is POST + check_token guarded.
• POST-only — password generation, password saves and settings saves reject GET with HTTP 405, even when a valid token is present.
• Validated input — user ids are cast to int, password length is clamped to 8–64, character types are whitelisted, and password values are decoded through WHMCS's Sanitize.
• Least privilege — only configured admin roles see the change-password action.
• No secrets in logs — the raw password is never written to the audit log, and the change-password email is excluded from WHMCS's email log.
• Defence in depth — every PHP file refuses direct web access, and the bundled .htaccess blocks .tpl/.md files and the compiled-template directory on Apache.
• Audit trail — every change logged with actor, IP and browser user-agent.

Support

• Documentation: this site + the module README.md.
• Before reporting: include your WHMCS version, module version and relevant Activity Log rows.