WHMCS Custom Module Code Security Review

This package reviews the source code of custom or third-party WHMCS addons, hooks and gateway modules for SQL injection, broken access checks, unsafe file handling and exposed API credentials, and gives you a report with code-level fixes and a retest. It is for hosting companies whose billing system runs code that nobody has read since the developer who wrote it moved on.

What I read for

• Database calls built from request values instead of Capsule's query builder with bound parameters.
• Addon output pages and client area actions that never check the admin's role or that the service belongs to the logged-in client.
• Hooks that trust the values passed in, and AJAX endpoints reachable without a session.
• Upload and download handlers open to path traversal or that store files inside the web root.
• Gateway secrets, registrar passwords and API keys hard-coded, written to the module log or stored unencrypted.
• Smarty output that is not escaped, and admin forms without a CSRF token.

Where this sits next to other WHMCS work

The WHMCS Security Audit and Hardening package checks your install's settings, folders and admin accounts. This one reads code, line by line. If you need the install itself audited, or recovery after a hack, see the WHMCS security audit service. Premium confirms each finding on a staging WHMCS install, never on your live client data, and includes patched code for every in-scope finding.

Honest limits

ionCube-encoded files cannot be reviewed; only readable source can. For a module you bought, check that its license allows a review; findings in vendor code are reported to you, and with your permission I write them up for the vendor so the fix reaches every customer. The review needs your signed go-ahead covering the code and any staging system, the code is used only for this job, and I sign an NDA on request.