UQUICK Security

Application protections

• Password hashing and prepared PDO statements.
• CSRF protection for state-changing requests.
• Secure session cookie settings and session ID regeneration at login.
• Server-side authorization checks for private conversations and attachments.
• File type and MIME validation with private storage paths.
• Rate limits for sensitive actions and an administrative audit log.
• Encrypted storage of browser push subscription details.

Transport and message encryption

HTTPS should be enabled on the deployed domain. This release does not implement end-to-end message encryption. Messages are stored by the application server to provide messaging functionality.

Operator responsibilities

Keep PHP and MySQL updated, protect database credentials and VAPID private keys, maintain off-host backups, restrict storage permissions, and monitor server error logs without logging message bodies or secrets.