# Security acceptance tests
- Unknown email: Cloudflare denies.
- Approved email + OTP: Cloudflare allows.
- Approved Cloudflare email not present/active in DB: application denies.
- Revoked client: application denies.
- Expired client: application denies and changes status to expired.
- Browser changes payment amount: backend ignores it and uses service price from DB.
- Duplicate Paystack webhook: no duplicate fulfillment.
- Invalid webhook signature: HTTP 401.
- Direct `/storage/private/...`: impossible because storage is outside public root.
- Direct `.env`: impossible because `.env` is outside public root.
- CSRF token missing: write action rejected.
- Admin disabled: login rejected.