Security

SHAMOGRIK requires authenticated access to protected application areas and applies role, membership, organization, and branch-aware authorization to sensitive workflows.

• Authenticated application access
• Role and permission checks
• Organization and branch scope
• Restricted sensitive operations

SHAMOGRIK is designed as a multi-tenant platform. Business records are scoped to their organization and, where applicable, branch context. Backend authorization is treated as the source of truth for access decisions.

Sensitive workflows are designed around server-side validation, explicit state transitions, auditability, and history-preserving behavior. Critical records should not rely on frontend-only validation.

POS workflows use controlled cashier access, terminal and register context, business-day state, and device-aware controls. Security-sensitive device setup and offline synchronization are treated as explicit platform boundaries.

Where offline-capable workflows are supported, SHAMOGRIK uses operation identity and synchronization rules intended to reduce duplicate processing and unsafe replay. Offline capability does not remove server-side authorization and reconciliation requirements.

Security-sensitive modules are backed by automated tests covering permission boundaries, tenant isolation, invalid states, duplicate prevention, and other critical invariants. Controls continue to evolve as the platform matures.

Do not publicly disclose sensitive vulnerability details before the operator has had a reasonable opportunity to investigate. Send suspected vulnerabilities or unauthorized-access reports to contact@abdullahstack.com with enough detail to reproduce the issue safely.