Products, prices, allergens, availability and offers must be controlled before public ordering.
ORDER TRUST
Food, catering and loyalty need clean operational rules.
MY PLACE ordering, catering and brand-family routes should keep menu data, payments, kitchen status, delivery zones and loyalty rewards consistent before real ordering begins.
Payments should be tied to confirmed order totals and refund/cancel rules.
Pickup, courier and delivery-zone states should be timestamped and easy to audit.
MI Coins, vouchers and birthday offers need expiry, usage and abuse rules.
Public safety
Current hardening
Static source files, backups and zips are blocked.
Directory listing is disabled.
Headers reduce common browser-side risks.
Operational dashboards are not public menu pages.
Before live orders
What still needs real testing
Real menu editor, cart, payment test, kitchen display, delivery-zone logic, coupon redemption and refund paths must be tested before advertising ordering.