Please don't make these "Potential improvements" - use SSL pinning. - block different GMail emails from the same Google user. - prevent different users from

Please don't make these "Potential improvements" - use SSL pinning. - block different GMail emails from the same Google user. - prevent different users from using the same credit card. These are user hostile. I see no legitimate reason to do so. Though limiting coupon use with same base email/card/.. is reasonable. - require more information than just an email address. Maybe you need to (e.g. theft) but coupon reuse prevention is overreaching. - don't email the promo codes in plain text. ... It could also be built as a deep link into the app Is this assuming iOS use and opening the mail on the phone? EDIT: If you disagree, please state the reason. To elaborate: Paying for your kid, spouse or friend from a single card seems reasonable. Not everyone has lots of cards. As for email canonicalization: What if you lose access to your account, want one for kids, separating work/personal .. don't do it by default unless you do have a good reason. You're just adding minor inconveniences and possibly serious vulnerabilities (using random email forwarders along with typical email password resets). Certificate pinning to deny user access - your APIs should be secured by making them secure and it will actually work. Data itself (also) belongs to the user, not (only) to the service provider. Some may disagree, but laws in some countries state so.