Understand QCMM Security, Secrets, CSRF, and Privacy Boundaries

Understand QCMM's security boundaries for server authorization, CSRF, encrypted secrets, ownership checks, payment/Meeting credentials, and privacy-sensitive data.

The UI Is Not the Authorization Boundary

QCMM does not rely on a hidden button or unavailable menu item as proof of authorization. State-changing and protected operations re-check the current Joomla identity, component/role permissions, object ownership, entitlement, and current record state on the server.

CSRF Protection

Administrator and frontend mutations use Joomla token checks appropriate to their request method. Report CSV export, for example, validates a GET token before streaming. A failed token check must be treated as a rejected request, not bypassed by changing frontend markup.

Sensitive Settings

QCMM supports encrypted storage for sensitive settings through its secret store and resolves encrypted values before legacy/plain fallback. Payment credentials, private Meeting credentials, license material, and similar secrets should never be placed in screenshots, URLs, documentation examples, browser-visible markup, or community posts.

Ownership and Least Exposure

Customer-facing operations should expose only the identifiers and data required for that user. Protected downloads, subscriptions, bookings, invoices, and Meeting actions validate ownership/access server-side before returning protected content or changing state.

Preserve Audit Evidence

When troubleshooting, prefer in-place repair and recorded state transitions over deleting subscription, billing, payment-event, booking, attendance, credit, fulfillment, or entitlement history. Logs and identifiers are useful for support, but redact secrets and unnecessary personal data before sharing them.

Community Discussion

Want to compare QCMM workflows or share practical tips? Visit the QC Memberships & Meetings Community. For private support, bug reports, account-specific entitlement or billing problems, or feature requests, use the QuantaCade support system.