Security Practices
At Venomin, operated by Walletmix Limited, security is built directly into our platform architecture, authentication layer, and service orchestration engines.
01. Security Architecture & Defense in Depth
Venomin employs a defense-in-depth security model spanning our edge network, application tier, database layer, and external product adapters. Our security philosophy prioritizes verifiable cryptographic controls, strict tenant data isolation, and programmatic production gates.
02. Account Authentication & Password Hashing
All user passwords on Venomin are hashed using bcrypt with a work factor of 12 salt rounds. We enforce the following cryptographic standards:
- Passwords are never stored in plaintext, reversible formats, or environment files.
- Cryptographic salts are uniquely generated per user record to mitigate rainbow table attacks.
- Password verification uses constant-time string comparison algorithms to prevent timing-based side-channel attacks.
- Case-insensitive email lookup with whitespace normalization is applied during authentication while preserving passwords byte-for-byte.
03. Stateless Session Management & Cookies
Venomin utilizes cryptographically signed stateless session tokens (JWTs) generated with HMAC-SHA256 signatures via the jose library.
Cookie Attributes: Session cookies are set with HttpOnly: true (inaccessible to browser JavaScript), SameSite: lax (CSRF protection), and Secure: true in production environments.
Token Expiration: Session tokens carry strict expiration lifetimes and encode verified user identities and administrative roles.
04. Role-Based Access Control (RBAC)
Venomin enforces granular role-based permissions across all administrative routes, API endpoints, and data operations:
05. Production Dual-Gate Safeguards
Venomin enforces a strict programmatic dual-gate safeguard (ENABLE_PRODUCT_PRODUCTION_INTEGRATIONS=false by default). Direct automated provisioning into live third-party product environments is strictly blocked until an authorized administrator verifies the 8-point production checklist and executes a signed two-step audit verification.
06. Encryption in Transit & Transport Security
- All communications with
venomin.comare encrypted in transit using TLS 1.3 / HTTPS. - HTTP Strict Transport Security (HSTS) headers are enforced to prevent protocol downgrade attacks.
- Modern security headers (
X-Content-Type-Options: nosniff,X-Frame-Options: SAMEORIGIN, and Referrer-Policy) are delivered on all responses.
07. Signed Webhooks & Service Authorization
Inter-service communication between Venomin and connected product adapters (Rentmix, VitaERP, ECOPOS, BizERP, EduERP, CityERP) is secured via cryptographic signatures:
- HMAC-SHA256 Webhook Signatures: Webhook payloads carry an
X-Venomin-Signatureheader generated from the raw JSON payload and a shared secret key. - Replay Protection: Webhook deliveries require timestamp headers validated within a 5-minute threshold window to prevent replay attacks.
- Service JWT Scopes: SSO launch requests and provisioning instructions carry short-lived tokens restricted to specific target product scopes.
08. Security Audit Logging & Telemetry
Venomin maintains structured, queryable audit trails recording security-relevant events in PostgreSQL:
Audit log metadata is sanitized before persistence and contains zero plaintext passwords, hashes, JWT tokens, or raw payment card data.
09. Backups, Disaster Recovery & Rate Limiting
The production database (venomin_prod) is backed up through timestamped, gzip-compressed SQL dumps stored in protected directories with restricted root permissions.
Sensitive endpoints (e.g. login routes, sandbox provisioning, quotation creation) are protected by in-memory sliding window limiters to prevent brute force and volumetric abuse.
10. Data Boundaries & Sensitive Record Segregation
Venomin serves as a centralized control plane for commercial subscriptions, account provisioning, and platform health telemetry. Under our data boundary architecture, sensitive vertical domain records (such as clinical medical histories, student minor records, citizen NID records, general ledger journal entries, and raw POS swipe credentials) remain partitioned within the customer's respective vertical product environment and are not routinely ingested by the central Venomin platform.
11. Vulnerability Reporting & Security Contact
We welcome responsible disclosure of potential vulnerabilities. If you discover a security issue or require technical security verification regarding Venomin: