Security & Support

How the module stays safe — and where to get help.

Security model

• Never fatal — hooks, endpoints, modal and cron code run inside try/catch; failures return JSON errors, never white screens.
• CSRF tokens — every state-changing admin and client action is POST + check_token guarded.
• Validated input — ids cast to int, types whitelisted, colors strict hex, keys allowlisted.
• Least privilege — owner-or-flagged enforcement on sidebar, modal and all mutating actions; cancel is scoped to the caller's own rows.
• Secrets stay secret — captcha keys and verification codes are hashed/masked; the audit log never stores readable secrets.
• Contained writes — only the module's own tables; corrupt/legacy data is skipped, never fatal.

Support

• Documentation: this site + the module README.md.
• Online docs: hardsoftcode.com/documentation/deleteclose-account.
• Before reporting: check Troubleshooting and include your WHMCS version, the module version (whmcs.json), and the relevant Activity Log rows.