–Security: live delivery prices for shop visitors are rate-limited (20 per minute per visitor, 300 per minute per shop, on a cache miss) — a burst of invented addresses could make the shop send unlimited price requests to Econt and Speedy on its own account. Over the limit the courier shows no price for that moment, never free delivery.
–Security: the public Econt office-list endpoint checks the city against the shop's own list and is rate-limited.
–Speedy city search no longer uses up the shop-wide limit for answers it already has.
–A VAT number longer than any EU format is refused before it is looked up.
–Checkout block map: courier office names and addresses are shown as text.