Never trust the browser about money
VedaGlowA payment confirmation arriving from client-side code proves nothing — anything the browser sends can be forged. Verifying the Razorpay signature on the server before marking an order paid is the line between a payment system and a hopeful one. Building that in VedaGlow changed how I think about every client-supplied value.
Payment method is a market decision
VedaGlowCard-first checkout underperforms in Indian D2C. Cash on delivery converts, but exposes the seller to refused deliveries. Splitting the difference — a small advance captured online, balance on delivery — took real design work and did more for conversion than any UI change I made.
Authorization belongs in the database
GharBazaarWith four roles and 58 tables, enforcing access only in route handlers means every new endpoint is a fresh chance to leak someone's KYC document. Moving the rules into 128 Row-Level Security policies changed the failure mode: a forgotten filter now returns nothing instead of returning another user's data.
Derived data should be computed by the database
GharBazaarCampus distance is the entire product promise, so it cannot be something a seller types in. Making it a PostGIS value computed by a trigger — and recomputed whenever a property's pin moves — removed a whole class of drift bugs that application-side calculation would have kept reintroducing.
Cart state is harder than it looks
VedaGlowPersistence across refreshes, price changes while an item sits in the cart, coupon eligibility recalculated on every mutation — each is a distinct edge case. Persisting locally keeps guest checkout frictionless, but only because totals and line items are re-validated server-side before an order exists.
Tests changed the schema, not just the code
GharBazaarSeveral Row-Level Security gaps in GharBazaar surfaced because a test asserted a user could not read something and it turned out they could. Writing the tests alongside the features caught design problems, not just regressions.