Security

Security model for the MVP.

Server-side roles

Admin, manager, and cashier access is checked in Nuxt server API routes before data is returned.

HttpOnly sessions

Login sessions are stored in HttpOnly cookies and signed with a server-only secret.

Phone connection key

SMS mirroring requires a private shop connection key. The key is only available to owners during phone setup.

No MoMo PINs

The product never needs the owner’s MoMo PIN, SIM credentials, or wallet password.

Pre-launch checklist

  • Rotate development Neon and app secrets before production use.
  • Review Privacy Policy and Terms with local legal counsel.
  • Keep rate limiting and request logging around SMS forwarding endpoints.
  • Keep the owner workflow for resetting phone connection keys.