Here are some general tips on securing your Kill Bill installation:
Install Kill Bill behind a firewall (it should not be exposed on the public internet).
Change the default username/password (admin/password) in your live environment.
Don’t store sensitive data in Kill Bill. While most plugins have support for directly saving card or bank account numbers for instance, this should only be used for testing purposes or if you use a proxy tokenizer: if you don’t, use a third-party vault.
Encrypt username and passwords in configuration files.
Use SSL for all communication with your eCommerce application as well as with the payment providers.
Subscribe to our Community mailing list to receive security advisories.
Never store security codes (CCV, CVV, etc.) in your live environment.
It is eventually your responsibility to make sure your Kill Bill installation is secure and compliant.