Vishal Kumar Thakur.

Payment webhooks are HMAC-verified

Razorpay callbacks are rejected unless the signature validates against the raw request body. Order totals are recomputed on the server at capture time, so the client never gets a say in what it owes.

IDOR protection across every resource

Ownership is enforced at the query layer, not the route. A customer cannot fetch, mutate or refund another customer order by changing an ID, and a shopkeeper is scoped to their own outlet.

Timing-attack fixes on secret comparison

Token and signature checks were rewritten to constant-time comparison after the naive equality checks turned out to leak length and prefix information under timing measurement.

Forward-only order state machine

Orders move through a fixed sequence and cannot be replayed, reversed or skipped. A retried webhook or a double-tapped button lands on the same final state instead of double-charging.

AI interpretation grounded in real chart data

Prokerala returns the chart mathematics; Claude turns it into readable interpretation. The prompt is bound to the computed chart so the model explains that data rather than inventing a horoscope.

Bilingual end to end

English and Hindi across the UI, the chart labels and the generated interpretation — not a translated menu bar sitting on top of English output.

Islands architecture keeps it fast

Astro 5 ships the chart pages as mostly static HTML and hydrates only the interactive pieces, so a chart loads quickly on the low-end Android phones most of the audience uses.

RAG over pgvector, not a bare LLM

Questions are answered from embedded shop and catalogue content retrieved out of pgvector on Neon Postgres, with Gemini generating from those passages. Grounding it in real content is what stops it inventing prices.

Daily rate posting via GitHub Actions

A scheduled workflow pulls the day gold and silver rates, renders the post and publishes it. The shop daily rate update went from a manual chore to a cron line.

Islands keep the chatbot off the critical path

The storefront is static Astro output and only the chat island hydrates. A visitor browsing rings never pays the JavaScript cost of a chatbot they did not open.