Account identity is enforced in the database, not the browser: a verified phone number is unique across active accounts, balance changes pass only through audited server-side functions, and the transaction ledger is append-only.

Secrets such as payment keys never reach client code. To report a vulnerability, use the Contact page with enough detail to reproduce the issue, and please do not disclose it publicly before we have responded.