Assume external input is untrusted
Browser requests, webhooks, CSV imports, provider callbacks and internal integrations should each cross an explicit validation boundary before they can change commerce state.
Give each runtime only the access it needs
Separate public website permissions from commerce application permissions. Workers, operators and provider adapters should use the minimum database, filesystem and network access required for their jobs.
Keep secrets server-side and rotatable
Do not expose signing secrets, payment credentials or private API keys to browser code. Store secrets outside deployable content and support rotation without rebuilding the public site.
Make sensitive changes attributable
Administrative changes, manual replays and recovery actions should capture who performed the action, when, the affected object and a safe reason/reference.
Use these patterns to structure a Thonem project, then verify the exact routes, providers, secrets, queues and infrastructure of the deployed environment before changing production.