Security practices and vulnerability reports

Raseedo handles invoice records and credentials used to communicate with ZATCA. We want reports of security problems so they can be investigated and corrected. This page explains how the plugin stores sensitive information, where invoice data goes and how to disclose a vulnerability.

How the plugin protects your store

Raseedo encrypts its private keys and certificates using the WordPress site's AUTH_KEY and SECURE_AUTH_KEY. The keys used for encryption belong to your site. If either WordPress key changes, you need to complete onboarding again with a new Fatoora OTP. Invoices already issued are not affected.

Administrative actions use WordPress nonces and capability checks. These checks are applied to each admin action in the plugin to restrict who can make changes through its administrative screens.

Invoice documents are sent to ZATCA's Fatoora API at gw-fatoora.zatca.gov.sa. Raseedo does not start sending e-invoices until you complete onboarding and turn on "Issue e-invoices". Signed XML documents and ZATCA responses are stored on your own WordPress site. They remain there after uninstalling unless you explicitly choose to delete everything.

How the website is protected

The Raseedo website uses HTTPS with HSTS and a content security policy. It has no contact forms or visitor account system. Contact with the developer is handled by email.

The website runs on Vercel, which processes visitor IP addresses and request details to serve pages. Google Analytics 4 loads through Google Tag Manager only after a visitor accepts the cookie banner. Advertising and remarketing are not used.

Reporting a vulnerability

Send your report to info@raseedo.com with "Security" in the subject line. Include the affected Raseedo version, the steps needed to reproduce the issue and a description of what happens. If the issue involves a particular WordPress, WooCommerce or PHP version, include that information too.

Please test only on sites that you own or have permission to test. Do not attempt to access another store's invoices, keys or customer records. Do not publish details of a vulnerability before a fix is available.

You can also find security contact information at /.well-known/security.txt.

What to expect after a report

We aim to acknowledge a security report and address a confirmed problem in the next release. There is no promised acknowledgement date, fix date or release schedule. The time needed to investigate an issue may depend on its cause and the affected versions.

Raseedo does not offer a bug bounty or payment for vulnerability reports. You can still send a report using the email address above. Please provide enough detail to reproduce the problem without exposing information belonging to other stores.