SODA ZW BILLING V13 — SECURITY HARDENING
Build: 20260723-sodazw-v13-security-hardening

IMPORTANT
=========
This release contains no live database password, Paynow key, WhatsApp token,
production log, SQL backup, or private config/config.php.

BEFORE DEPLOYMENT
=================
1. Rotate the database user's password in cPanel.
2. Rotate the Paynow Integration Key in Paynow.
3. Back up the current billing files and database to a protected off-site
   location.
4. Update the existing private config/config.php directly on the server with
   the rotated values. Do not download or share that file.
5. Add this optional section to the existing config if it is not present:

   'security' => [
       'trusted_proxy_ips' => [],
   ],

   Leave the array empty unless the billing origin is behind a known reverse
   proxy. Only list the exact proxy IP addresses permitted to set
   X-Forwarded-Proto.

UPLOAD
======
Upload and extract sodazw-billing-v13-hardened.zip into the existing document
root for billing.sodazw.co.zw. Allow application files to overwrite matching
files. The ZIP deliberately has no config/config.php and will not replace the
private production configuration.

REMOVE FROM THE PRODUCTION DOCUMENT ROOT
========================================
- install.php
- every ZIP, SQL, LOG, BAK, and release-instruction file
- .well-known.zip
- storage/php-error.log from any deployment archive (the live application will
  recreate its protected runtime log when necessary)
- old copies of config/config.php outside the protected config directory

The supplied .htaccess blocks these artifact types as a second line of defence,
but unnecessary files should still be deleted from production.

AFTER DEPLOYMENT
================
1. Confirm HTTPS redirects correctly.
2. Confirm login succeeds and logout submits successfully.
3. Confirm the footer build reads:
   20260723-sodazw-v13-security-hardening
4. Submit one pickup test order from https://sodazw.co.zw.
5. Submit one Harare delivery test order and confirm the server adds USD 10.
6. Confirm an outside-Harare Paynow order is saved without premature payment.
7. Start one Paynow test checkout and confirm the browser remains on an HTTPS
   paynow.co.zw address.
8. Confirm a completed Paynow test creates only one payment record.
9. Confirm /robots.txt disallows all billing pages.
10. Confirm /install.php returns access denied.
11. Review the error log and security/audit activity.

CRON
====
Prefer a PHP CLI cron command for daily-maintenance.php. If HTTP cron is
unavoidable, send the cron token in:

Authorization: Bearer YOUR_PRIVATE_CRON_TOKEN

The old query-string token remains temporarily compatible, but should be
retired because URLs are commonly logged.

STOREFRONT CONTRACT
===================
The existing main storefront remains compatible. It sends only customer
details, fulfilment choices, SKUs, quantities, and an idempotency key. Billing
continues to calculate authoritative prices and delivery fees.

REMAINING INFRASTRUCTURE WORK
=============================
- Enable MFA for cPanel, Paynow, email, and database administration now.
- Application-level staff MFA requires a separate enrolment and recovery
  release and is not silently enabled by this package.
- Put billing.sodazw.co.zw behind managed WAF/rate limiting if available.
- Store encrypted backups outside the public document root and test restores.
- Keep products and stock current in Billing so storefront orders are priced
  from accurate server-side data.