Security

Security is a core priority at S.S.S. Corporation. We are committed to protecting the data of our users, customers, and partners. This page outlines our security practices and how to responsibly report vulnerabilities.

Our Security Practices

HTTPS Everywhere

All data transmitted to and from our services is encrypted using TLS/SSL protocols.

Strong Authentication

Admin access requires email + password combined with OTP-based two-factor authentication.

Secure Data Storage

All passwords are hashed using Argon2id. Sensitive data is encrypted at rest.

Rate Limiting

Input Sanitisation

All user inputs are sanitised and validated to prevent SQL injection and XSS attacks.

CSRF Protection

All forms include CSRF tokens to prevent cross-site request forgery attacks.

Security Headers

Our web server implements the following HTTP security headers on all responses:

X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN (clickjacking protection)
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation, microphone, and camera restricted
Session Cookies: HttpOnly and SameSite=Strict flags enabled

Access Control

We follow the principle of least privilege across all systems:

Admin panel is protected by email + password + OTP verification
Database access is restricted to dedicated application users with minimal permissions
Sensitive directories (source code, environment config, database files) are blocked from web access
File uploads are restricted to allowed types and stored outside the web root where possible

Vulnerability Disclosure Policy

We welcome responsible disclosure of security vulnerabilities. If you discover a security issue on any of our websites or services, we ask that you:

Report it to us privately via email before public disclosure
Provide sufficient details to reproduce the issue (URL, steps, screenshots)
Allow us reasonable time (typically 30 days) to investigate and resolve the issue
Not exploit the vulnerability, access user data, or disrupt our services during disclosure

We do not operate a bug bounty programme at this time, but we genuinely appreciate responsible researchers who help us improve our security posture.

Found a Security Issue?

Report it privately and we'll investigate promptly. Please include details of the vulnerability, affected URL, and steps to reproduce.

business@ssscorp.in

Scope

This security policy covers:

ssscorp.in — Main corporate website
snippetsoft.com — SnippetSoft platform
bizmini.in — BizMini ERP platform
drobo.in — Drobo Education platform

Contact

Security reports: business@ssscorp.in
General enquiries: business@ssscorp.in