Straight talk
Launch readiness
What is in place, and what must still happen before GlowNearMe takes real bookings. Nothing here is presented as verified unless it has been tested.
Built safeguards
- Payments, refunds, payouts and subscriptions use stored requests with idempotency keys, so a retry never charges, refunds or pays twice.
- Stripe webhooks are signature-checked and processed once per event; protected scheduled tasks need a long shared secret.
- Lists (bookings, notifications, payouts, reviews, ledger) are paginated; search and sign-in-adjacent actions are rate limited.
- Financial history is append-only: corrections are separate reversing journals, with database guards installed from the Payments page.
- Customer phone numbers and addresses are encrypted; certificates are encrypted and private. No card data is stored.
- Deterministic checks cover pricing, commission, cancellation, availability, quota, ledger balance and reconciliation rules.
- The administrator console opens only after an authenticator-app code is verified in the current session; market administrators see one country, and every action is written to an audit log that can be exported.
Launch gates still open
- Magic-link sign-in is not supported by the built-in account service, so sign-in is email and password only. Administrator two-factor sign-in is a GlowNearMe authenticator-app step added on top of that account service, and has not had an external security review.
- Nobody has been designated an administrator yet. Set a user’s role to admin in Backend → Users (or list verified emails in a SUPER_ADMIN_EMAILS secret); that super administrator then sets up two-factor sign-in and adds market administrators.
- Card, FPX (Malaysia), PayNow (Singapore) and GrabPay checkout are written through Stripe but have not been run against a connected Stripe account; each must be enabled in Stripe and tested in sandbox. Customer charging stays closed until that and the other gates below are cleared.
- Scheduled tasks (payment recovery, completion, payouts, reconciliation, notifications, subscriptions) need an external scheduler to call them.
- Load and performance targets (search under 800 ms, slots under 500 ms, 10,000 providers) have not been tested.
- An external security review, data-residency decision, backup and recovery (RPO/RTO) proof, uptime monitoring, error tracking and legal sign-off are still required before launch.
- Tax rates and registration thresholds for Malaysia and Singapore need approval.
Search visibility checklist for the owner
Open this project’s SEO/GEO tab to finish the remaining search settings. This checklist is guidance only: it does not apply search exclusions or change sitemap addresses. Private account access still requires sign in regardless of search visibility.
- Keep private workspaces out of search. Set private pages to noindex and nofollow, and exclude them from the sitemap. Include customer account, bookings, favourites and checkout; professional onboarding, dashboard, calendar, team, services, financial pages and notifications; and both administrator pages. Apply this to the older plain addresses as well as their customer and professional portal addresses.
- Keep public discovery visible. Keep the homepage, Discover, Directory, approved provider profiles, public Community, the professional welcome page and public guides available to search engines. The professional welcome page at
/prois public; the workspace pages below it are private. - Use the addresses visitors actually see. The customer account is
/customer/account, bookings are/customer/bookings, the professional dashboard is/pro/dashboardand onboarding is/pro/onboarding. Remove private workspace addresses from the sitemap rather than adding their portal versions. Where a private page needs a preferred address, use its portal address instead of the older plain address. - Review crawler and AI reading settings. Add crawler exclusions for private portal pages and administrator pages without blocking the public
/prowelcome page. Keep the AI reading summary focused on public discovery and guides, and explain that visitors can browse approved professionals and preview availability, but online payment is not available and unpaid holds do not confirm appointments. Crawler exclusions are not a substitute for sign in protection. - Check after saving. Run the SEO/GEO check again and inspect the sitemap, crawler rules and preferred addresses. These settings are not yet marked complete; this checklist does not change them automatically.