# Security review — 4.4.0

Reviewed surfaces: public booking and appointment-management AJAX, staff/customer portals, payment and integration webhooks, REST routes, diagnostics/backups, database writes, and Square mutations.

Release controls:

- Public appointment changes require the manage nonce, a high-entropy appointment token, rate limiting, server-side ownership lookup, and an appointment database lock.
- Service and option identifiers are validated as an active parent/owned main variation; client-supplied staff assignments are ignored.
- Square booking updates use booking versions, a stable payload-derived idempotency key, and post-error verification.
- Square and Stripe webhook signature regression checks run in the release gate.
- Backup, restore, diagnostics, finance exports, and retry actions require administrator capability plus a nonce.
- Dynamic dialog content is inserted as text, not arbitrary HTML; request tokens are unslashed before sanitization.
- Diagnostics exclude credentials and customer rows; operational history stores statuses and counts only.

This is an internal code and regression review, not a third-party penetration-test certification. A professional external review remains appropriate before materially expanding payment volume or public distribution.