Inventory & Order Management is a public web application without accounts. Its workspace is shared by every visitor, so anything a visitor enters is visible to the next one. Do not enter real inventory, customer or order information.

Report vulnerabilities privately through GitHub private vulnerability reporting. Do not disclose personal data or exploitable details in public issues. For anything else, contact Folder IT through folderit.net.

This is a static reference repository without a support commitment; reports are reviewed on a best-effort basis.

• Every request body, query string and response body is validated with Zod; malformed JSON is rejected with a 422.
• SQL is built with Drizzle's parameterized queries, and search terms escape LIKE wildcards.
• Stock changes run in transactions with row locks; database constraints refuse negative balances, zero deltas, negative prices and duplicate SKUs independently of the application.
• Order status changes use conditional updates, so a stale or repeated request cannot apply twice.
• Writes are rate limited per client (60 every ten minutes) to protect the shared workspace.
• The workspace is noindex. Security headers: X-Content-Type-Options, Referrer-Policy, X-Frame-Options and Permissions-Policy. The X-Powered-By header is disabled.

At the time of writing, pnpm audit --prod reports no known vulnerabilities in production dependencies. Development-only tooling reports a high advisory in braces through eslint-config-next (GHSA-vfj7-8cjw-p6xm) and a moderate one in an old esbuild through drizzle-kit (GHSA-67mh-4wv8-2f99); neither ships in the production build. Recheck pnpm audit before publication.