See MifosFaqs#What_security_does_Mifos_provide for a summary of some of the security features of MIFOS.

Technical aspects and TODOs

We prevent SQL Injection attacks by not building SQL statements directly from strings. See Hibernate documents for details (we used named queries which name variables to be substituted with a colon, for example :prdOfferingName).

In generating HTML, we need to quote all data (less than, greater than, and ampersand). Some of our code does this via MifosTagUtils#xmlEscape. You can help MIFOS by helping us find places we need to be calling it. This approach, of generating HTML via strings, is an error prone one; one easy step which can be implemented incrementally is to change string operations to XmlBuilder which automatically quotes all text which is output, and provides separate methods to safely generate tags.

See also