1 Application & Cloud Network Defense
VITRO operates on a hardened cloud infrastructure monitored 24 hours a day, 7 days a week:
- Role-Separated JWT Cryptography: Customer, Rider, Merchant, and Administrator APIs operate under completely segregated secret keys. An authenticated token from one role cannot access endpoints of another.
- Rate Limiting & Anti-Brute Force: Multi-tiered rate limiters in Express and Redis block automated credential stuffing and distributed denial-of-service (DDoS) attacks.
- Query Sanitization & NoSQL Injection Defense: All user input is rigorously sanitized through parameter typing and escape routines before database queries execute, preventing NoSQL selector injection and ReDoS attacks.
- Cloudflare Edge Defense: Automated SSL/TLS encryption, WAF (Web Application Firewall) rule sets, and bot mitigation protect our endpoints globally.
2 Payment & Financial Integrity
We protect consumers from unauthorized charges and protect merchants from fraudulent order dispatch:
- Cryptographic Webhook Signatures: Online payment status is verified via HMAC-SHA256 signature verification before an order is transitioned to
paid. - Anti-Bypass Protocol: Manual UPI submissions undergo automated structural validation and strict admin reconciliation before store dispatch buzzer notifications are released.
3 Partner Vetting & Physical Fleet Safety
Digital security extends directly into physical safety for our passengers and customers:
- Mandatory Government ID Vetting: Every delivery and ride partner must submit an Aadhaar Card, Driving License, and Vehicle Registration (RC) for manual ops verification before their account is activated.
- In-App Emergency SOS: During an active ride, passengers can trigger a one-tap SOS that transmits live GPS coordinates and driver vehicle details to their designated emergency contacts and our rapid-response safety team.
- Encrypted Calling: Riders and customers can communicate via in-app calling or virtual masked phone numbers to preserve personal phone number privacy.
4 Cryptographic Dual OTP Handshake
To eradicate false deliveries, lost packages, and wrong-order handoffs, VITRO enforces a dual OTP handshake:
- Pickup Code: Generated on the merchant's screen. The rider must physically verify this 4-digit code at the store counter before the order can leave the premises.
- Delivery Code: Sent exclusively to the customer's phone. The rider must enter this code at the customer's doorstep to complete the delivery and receive payout.
- Timing-Safe Verification: OTP comparisons on our backend utilize constant-time buffer evaluation (
crypto.timingSafeEqual) to eliminate side-channel timing attacks.
5 Geofenced Arrival Validation
Status updates are backed by mathematical GPS distance validation. A rider cannot mark "Arrived at Store" or "Arrived at Customer" unless their device GPS coordinates are within 300 meters of the registered destination. This prevents premature status changes and ensures real-world accountability.
6 Vulnerability Disclosure & Bug Bounty
We welcome collaboration with cybersecurity researchers. If you identify a potential security vulnerability within any of our applications or APIs, please report it to our security engineering team:
- Security Email: security@vitro.com
- PGP Key: Available upon request for encrypted reports.
- Response Commitment: We acknowledge all security reports within 24 hours and provide continuous remediation updates until the patch is deployed.