Security Policy
Last Updated: September 7, 2026 • Enterprise Infrastructure Defense
01. Security Architecture & Commitment
Security is foundational to the V-Air Ops platform. We operate a multi-tenant Virtual Airline architecture designed to ensure total data isolation between airline communities, secure API access, and encrypted telemetry transmission for ACARS flight tracking.
02. Technical Safeguards & Encryption
All web traffic, API requests, and ACARS client telemetry streams are strictly encrypted in transit using modern TLS 1.3 encryption protocols.
User credentials are protected using industry-standard bcrypt hashing. API authentication utilizes scoped Laravel Sanctum Bearer tokens.
Global middleware (`EnsureActiveAirlineSelected`) and tenant-scoped database queries ensure Virtual Airlines cannot access each other's private data or flight logs.
All form submissions enforce CSRF token validation (`XSRF-TOKEN`). Database interactions utilize parameterized Eloquent ORM queries to eliminate SQL injection risks.
03. ACARS Telemetry & V-AirOps Client Security
The V-AirOps ACARS desktop client establishes secure, authenticated web-socket and REST connections to the V-Air Ops telemetry endpoint. Telemetry packets are validated for active user session tokens, rate-limited against DDoS or spoofing attempts, and sanitized before storage in flight log databases.
04. Vulnerability Disclosure & Responsible Reporting
We welcome security researchers and community developers to report any security vulnerabilities responsibly. If you discover a potential security flaw in the V-Air Ops web console, API, or ACARS telemetry pipeline:
- Provide detailed steps or proof-of-concept (PoC) to reproduce the vulnerability.
- Allow reasonable time for our development team to patch the issue prior to public disclosure.
- Avoid accessing or modifying other users' data during testing.
05. Recommended Operational Security for VA Owners
- Role-Based Access Control (RBAC): Grant administrative staff permissions (`manage_fleet`, `manage_routes`, `manage_notams`) sparingly.
- API Key Safety: Do not publicly share VA API keys or Discord webhook URLs in public community channels.
- Session Protection: Always sign out of staff consoles when using shared computers.