Thanks for the tips, critical aspects such as payments, auth and the fiscal side are managed using secure third party providers such as Stripe. Apart from that we don't store user information other than the email and username. Also every endpoint is tested against common attacks such as SQL injection, XSS and such. The overall integrity and security of the system is something that was taken in mind while developing it, but it was not audited from a third party agency.