FacturaScripts compatibility: ≥ 2025.6. Moodle compatibility: ≥ 4.1.

Please do not report security issues through public GitHub issues, discussions, or pull requests.

Instead, send your report by email to:

security@facturascripts.com

If you want end-to-end encryption, fetch the PGP public key at:

https://diegomonroydev.com/.well-known/pgp-key.asc

and encrypt the report with:

curl -s https://diegomonroydev.com/.well-known/pgp-key.asc | gpg --import
gpg --encrypt --recipient 'security@moodlemanagement.diegomonroydev.com' report.txt

Key fingerprint (verify before trusting the key):

pub   ed25519/0xA1B2C3D4E5F60780 2026-04-17 [SC] [expires: 2030-04-17]
      A1B2 C3D4 E5F6 0780 1234  5678 90AB CDEF 1122 3344
uid   MoodleManagement Security <security@moodlemanagement.diegomonroydev.com>
sub   cv25519/0x778899AABBCCDDEE 2026-04-17 [E] [expires: 2030-04-17]

NOTE FOR RELEASE ENGINEER: replace the fingerprint above with the real one at the time of publishing https://diegomonroydev.com/.well-known/pgp-key.asc. This file commits a placeholder so operators know what to verify; the actual key material is hosted out of band.

1. Summary — one-line description of the issue.
2. Impact — what an attacker can do.
3. Reproducer — step-by-step, including the affected endpoint, request body, minimum permissions required.
4. Affected versions — which plugin release(s) you tested on.
5. Suggested fix (optional but welcome).

We follow coordinated disclosure. Once a fix ships and deployments have had time to update, we credit the reporter (unless anonymity is requested) in the CHANGELOG.md ### Security section.

In-scope:

• This plugin's PHP code, Twig templates, assets.
• The REST integration with Moodle (how we call, what we send, what we store).
• Data at rest in plugin-owned tables (moodle_*).

Out-of-scope (please report upstream):

• FacturaScripts core vulnerabilities → https://facturascripts.com
• Moodle WS vulnerabilities → https://moodle.org
• Third-party plugins we depend on optionally (Tickets, StockAvanzado…).

All 16 critical findings from the 2026-04-16 audit and all 6 blockers + 18 HIGH from the 2026-04-17 second-iteration audit are closed in v2.0. The current posture is summarised below — please do not file reports for the items listed as fixed.

The audit-log hash chain is stamped at write time and best-effort: two concurrent writers may read the same prev_hash and produce two rows pointing at it. The row_hash per-row integrity is unaffected (each row's hash covers its own content), but strict ordering is not cryptographically guaranteed in v2.0. A chain-verifier tool that flags parallel branches is v2.1 scope.

1. Internet → FS: Signed URLs + rate limit + CSP on PDF; HMAC
   • replay guard on webhook endpoint. All other plugin entry points require an authenticated FS session.
2. FS → Moodle: IpValidator blocks SSRF at the cURL boundary; Moodle WS token stored AES-256-GCM; Authorization: Bearer header used for binary downloads (F7.2).
3. Moodle → FS (webhooks): HMAC-SHA256 of raw body with per-instance shared secret, 5-min timestamp window, nonce replay guard, and an append-only audit log.
4. Operators at rest: soft-delete with restore/purge UI (F10.4). Audit log captures who did what (IDOR denials, rate limit hits, webhook rejections, certificate downloads, trash ops). PII in the log is masked via PiiMasker.
5. Integrity: SchemaMigrator is idempotent and transactional; BadgeSyncWorker cannot cascade (Insert-only wiring, guarded by a regression test).

If you find a new issue not covered above, please report it.

PHP hardening — full guide in docs/PHP-INI-HARDENING.md. Minimum settings for a production host:

; php.ini
expose_php                = Off
display_errors            = Off
display_startup_errors    = Off
log_errors                = On
allow_url_fopen           = Off
allow_url_include         = Off
session.cookie_secure     = 1
session.cookie_httponly   = 1
session.cookie_samesite   = "Lax"
session.use_strict_mode   = 1
session.use_only_cookies  = 1

Recommended deployment:

• HTTPS only, terminated at the edge with HSTS enabled (Strict-Transport-Security: max-age=63072000; includeSubDomains; preload).
• Moodle webservice user with least privileges — only the WS functions this plugin calls. See docs/EVENTS.md §4 for the full list, and the README.md service setup section for recommended service=<external_services.shortname>.
• Token rotation quarterly. The TokenCipher migration (F5.12) re-ciphers the token column on every Init run, so the operator only needs to re-paste the new token in the UI and save.
• Webhook secret rotation — generate a new webhook_secret on the instance edit form whenever a bridge worker is rotated. Save triggers TokenCipher re-encryption.
• disable_functions — include exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec,assert,eval at minimum. The plugin calls none of these.
• Firewall cron-only endpoints — the Moodle webhook receiver is public by design (HMAC is the authentication boundary), but if you never use it, block /ApiMoodleWebhook at the edge.
• Monitor the audit log. moodle_audit_log.outcome IN ('forbidden','rate_limited','bad_signature') should stay low. Spikes indicate attempted abuse.

Rotating FS_COOKIES_EXPIRE invalidates every TokenCipher and SignedUrl payload. Plan token re-entry before rotating.

Last updated: 2026-04-17 · finalised in V2.0-ACTION-PLAN F11.9.