Security

The safest architecture is holding nothing

BuyMeAGoddie never processes, holds, or routes money. Payments happen inside your supporter's own UPI app, protected by their UPI PIN and bank. The only payment data we store is your public UPI ID — the same one printed on shop QR stands across India.

We will never ask for

• Your UPI PIN
• OTPs of any kind
• Bank passwords or netbanking credentials
• Debit or credit card numbers

Anyone asking for these while claiming to be BuyMeAGoddie is attempting fraud — report it to us and to your bank.

Platform safeguards

• Row-level security on every database table — users can only write their own data
• All input validated server-side (Zod) and constrained in the database
• HTTPS everywhere, secure session cookies, modern security headers
• React's output encoding plus strict validation guards against XSS; no raw HTML is ever rendered from user content

Reporting a vulnerability

Found something? Email bhuvanboddu08@gmail.com — we respond fast and appreciate responsible disclosure.