Questions and answers
Short answers about registration, security, operations and cabinet workflows.
Security and data
What security measures does H-Script use?
H-Script uses prepared SQL statements, bcrypt for passwords and security answers, protected session cookies, CSRF tokens, TLS verification and security-related HTTP headers.
The security of a production installation also depends on its server, HTTPS configuration, credentials, updates, backups and external services.
Does H-Script provide DDoS protection?
No. Effective DDoS protection must be implemented at the network, CDN, reverse-proxy and server levels.
Use Cloudflare or a similar service together with request-rate limits and server monitoring.
What data is sent through telemetry?
An installation registers its domain, H-Script version, installation date and a random identifier. Public aggregate statistics are controlled separately.
Telemetry must not transmit individual user records, passwords, payment details or secret keys.
Can public statistics be disabled?
Yes. Public aggregate reporting can be disabled independently from installation registration.
How can I report a vulnerability?
Send vulnerability reports to security@h-script.com or use GitHub Issues.
Do not disclose actionable exploitation details before receiving a response and allowing time for a fix.
Features
Which payment gateways and currencies are supported?
The available gateways depend on the H-Script version and installed modules. Supported integrations are displayed in the administration panel when configuring payment systems.
Administrators can configure currencies, payment systems, exchange rates and operation directions. Review provider fees, currencies and callback requirements before enabling a gateway.
Can I add a custom payment gateway?
Yes. H-Script payment gateways are implemented as separate strategy classes. A new integration can be added without modifying a single monolithic gateway dispatcher.
Does H-Script provide an API?
Yes. REST API v1 provides user, balance, operation, deposit and withdrawal endpoints.
Access uses scoped, expiring and revocable Bearer tokens. A token secret is displayed only once and is never stored in plaintext.
Are multiple languages and custom themes supported?
The project includes Russian and English localizations now. Interface translations can be managed through the administration panel.
An administrator can also assign an existing theme from tpl/themes to a user. Missing templates automatically fall back to the base theme.
Are email and SMS notifications supported?
Email can be delivered through SMTP with STARTTLS on port 587 or SMTPS on port 465. A dedicated mailbox is recommended for production.
SMS delivery is available through the AtomPark/ePochta API and requires provider-issued public and private keys.
General
What is H-Script?
H-Script is a CMS for creating and managing financial projects. It includes user accounts, balance operations, deposits and withdrawals, payment gateways, a referral system, administration tools and a REST API.
Is H-Script based on the previous CMS?
H-Script retains ideas and business logic from the previous CMS, but most of its technical foundation has been rethought.
The project now has a new architecture, interface, template system, API, modern database access and stronger security.
What projects is H-Script intended for?
The platform is intended for projects that require user accounts, internal balances, deposits, withdrawals, payment integrations, referrals and central administration.
Installation owners are responsible for evaluating the legal, financial and technical requirements of their jurisdiction.
Is H-Script free and open source?
Yes. H-Script is distributed under the MIT licence. You may use, study and modify the project in accordance with the licence terms.
Is a licence key required?
No. H-Script does not require a commercial licence check or bind an installation to a licence key.
Can I modify the design and functionality?
Yes. You can create custom themes, payment integrations and modules, and modify the project source code.
Changes to core files may require manual conflict resolution during future updates.
Where can I try the demo?
A link to the demonstration installation is available on the H-Script home page.
Demo data and operations exist only for interface evaluation and have no financial value.
Support and contribution
Where is the source code?
The source code and public release history are available in the 0x241/h-script repository.
How can I report a bug or suggest an improvement?
Use GitHub Issues.
Include the H-Script version, installation method, expected behaviour and error details without passwords, tokens or other secrets.
How can I propose a partnership?
For partnership and business proposals, contact @hs_wscc on Telegram or email business@h-script.com.
Installation and updates
What are the H-Script system requirements?
Recommended environment:
- PHP 8.4;
- MySQL 8.4 or a compatible MariaDB version;
- HTTPS and system cron;
- PHP extensions: curl, DOM, GD, mbstring, PDO MySQL, SimpleXML, Sodium and OPcache;
- Redis is optional.
Building from source also requires Composer 2 and Node.js 20.
How can H-Script be installed?
Supported options include a published Docker image, a local Docker build, installation on a VPS with Apache or Nginx, and a prepared release archive for compatible shared hosting.
The published Docker image is recommended for most new installations.
Can H-Script run on shared hosting?
Yes, if the hosting provider supports PHP 8.4, MySQL, HTTPS, cron and the required .htaccess rules or web-root configuration.
Use the prepared release archive. A normal GitHub source ZIP may be insufficient because it does not include installed Composer dependencies.
What should I do after the first Docker installation?
After the database has been created successfully, set APP_AUTO_INSTALL=0 and apply the container configuration again.
APP_AUTO_INSTALL=1 is only intended for the initial bootstrap of an empty database and must not be used as an update mechanism.
What are cron and Redis used for?
Cron runs background tasks such as queue processing, notifications, operation checks and telemetry delivery. Docker includes a separate scheduler, while a traditional installation should request /cron?auto once per minute.
Redis improves caching performance. H-Script continues working when Redis is unavailable.
How should H-Script be updated?
- Back up the database.
- Save the configuration and user files.
- Deploy the new release or change the exact Docker image tag.
- Check for available migrations in the configurator.
- Review application logs and background jobs.
Production installations should use an exact version tag instead of latest.
What should be included in a backup?
A minimal backup should include the database, configuration, user uploads, local themes and modified templates.
Secrets and backups must not be stored in a public repository or a publicly accessible web directory.
Can I roll back to a previous version?
You can restore the previous Docker image or release files. If the update changed the database structure, a compatible database backup may also need to be restored.
Do not use APP_INSTALL_FORCE=1 for rollback because it may delete existing tables.