Security & Privacy

Access control

• Every table enforces row-level security; members can read and write only their own records.
• Roles (member, staff, admin) are stored in a dedicated roles table and checked server-side — never in the browser.
• Administrative screens are reachable only after a server-side role check, not by hiding menu items.

Identity documents

• NID, birth certificate, student ID and photo uploads are stored in private buckets.
• Files are readable only by the owning member and the verification desk, through short-lived signed links.
• Document review decisions are timestamped and attributed to the reviewing officer.

Verification privacy

• The membership register cannot be browsed, listed or exported by the public.
• Each verification requires the exact member ID or certificate number.
• Verification returns only name, category, district, dates and status — never NID, address, phone, email or payment data.
• Extended profile details appear publicly only when the member explicitly opts in from their dashboard.

Audit & accountability

• Approvals, rejections, payment confirmations, notice publication, certificate issuance and role changes are written to an immutable audit log.
• Audit entries record the acting officer, action, affected record and timestamp.
• Only administrators can read the audit log; nobody can edit or delete entries.

Application security

• All traffic is served over HTTPS with modern TLS.
• Passwords are hashed by the managed authentication service; NFF staff never see them.
• All form input is length-limited and validated on both the client and the server.
• Secrets and API keys are held server-side only and are never shipped to the browser.

Responsible disclosure

If you discover a vulnerability, email office@nffbd.org with the subject lineSECURITY and a description of the issue and steps to reproduce. Please do not access, modify or publish other members' data. We acknowledge reports within three working days and credit researchers who report responsibly.

Suspected forged ID cards or certificates should be reported to office@nffbd.org or +880 1977-400400 with the serial number shown on the document.