Security Architecture

POPEVENTA is engineered with pessimistic row locking inside MySQL 8 transactions with REPEATABLE READ isolation to eliminate race conditions and TOCTOU concurrency hazards.

All Razorpay webhook payloads are authenticated using HMAC-SHA256 signatures with IP-allowlisting and idempotent processing backed by database UNIQUE constraints.