Pdfboxi.in Website - Audit and Patch Report
=========================================

Package reviewed: pdfboxi-website
Audit date: 10 November 2026

Checks completed
----------------
- PHP syntax: all 7 PHP files pass `php -l`.
- JavaScript syntax: all 7 first-party JavaScript files pass `node --check`.
- Local HTML href/src references: no missing local files found.
- Sitemap: all 89 listed URLs map to files/pages in the package.
- Tool registration: all 61 page tool identifiers are registered in the bundled tool scripts.
- Bundled PDF.js, pdf-lib, JSZip and Tesseract assets are present.

Changes made
------------
1. Payment verification in public_html/api/pay.php:
   After checking the Razorpay checkout signature, the server now retrieves the payment
   directly from Razorpay and checks the order ID, amount, INR currency, captured status
   and captured flag before activating a paid plan. This prevents an authorized-but-not-
   captured payment or mismatched payment from receiving plan access.
2. Service worker cache version bumped to invalidate previously cached files after upload.
3. README installation guidance corrected: the private configuration/database folder
   must remain outside public_html. The previous fallback suggesting placement inside
   public_html was unsafe on hosts that ignore .htaccess.
4. README now clarifies Razorpay key handling and the new server-side payment checks.

Important items that still require your hosting/account setup
-------------------------------------------------------------
- Enable PHP 7.4+ (PHP 8.x recommended) and these extensions on GreenServer:
  pdo_sqlite (or pdo_mysql), curl, openssl, mbstring and json.
- The included Razorpay key_secret is a placeholder. Add the matching LIVE key pair
  in pdfboxi_private/config.php before accepting payments. Never share key_secret.
- Configure a working email method (SMTP recommended) before testing signup OTP,
  password reset or receipts.
- Keep pdfboxi_private outside public_html and make its data/ and logs/ folders writable
  by PHP.
- Enable SSL/HTTPS before launch. Review business identity, contact address, tax and
  refund-policy wording before accepting real payments.

Runtime limitation
------------------
This package was statically audited and syntax-checked. A live browser test, database
test, email delivery test and Razorpay transaction test require your actual GreenServer
hosting account, enabled PHP extensions, domain SSL, mailbox and Razorpay credentials.
The PHP environment used for this audit did not have pdo_sqlite, curl or mbstring enabled,
so those server-dependent flows could not be executed here.

This report does not guarantee third-party hosting compatibility or search ranking.