Security

• Verified sessions. Every API call carries a short-lived token that the server re-verifies — page shells never grant access by themselves.
• Passwords are hashed with bcrypt; reset links are single-use and expire.
• Suspended accounts stop ordering immediately while keeping read access to their own history.

• Row-level isolation. Users, orders, wallets and notifications are scoped so accounts can only ever read their own rows — enforced in the database, not just the UI.
• Secrets stay server-side. Payment keys and database credentials never ship to the browser; the app boots from a public config endpoint.
• Hardened transport. Strict security headers, HTTPS-only cookies and rate-limited login and signup endpoints.

• Server-priced orders. The browser sends items and choices; prices, discounts, tax and fees resolve on the server and the bill is recomputed by the database. There is no way to pay less than the menu says.
• Card data never touches us. Online payments run entirely through Razorpay — we store references, never numbers.
• Every money movement is a ledger row. Wallet credits, settlements, refunds and reversals are append-only and admin-audited.

Found something? Contact us with the details and steps to reproduce — please give us a reasonable window to fix it before disclosing publicly. We take every report seriously.