Security

Customer and admin sessions are httpOnly cookies signed with AUTH_SECRET.

Payment webhooks are accepted only when the eKart signature matches the raw request body.

Keep service account keys, database URLs, and payment secrets in .env.local, never in the browser.