Security

The order is marked paid only after your server checks Razorpay, not after the browser says so.

• Signature and amount. The return from Razorpay is checked with HMAC-SHA256 and your Key Secret. The amount and currency must match the order. A tampered or replayed confirmation is rejected.
• Exact paise. Prices are converted to paise with exact decimal arithmetic, so 1250.50 INR becomes 125050 paise.
• Signed webhooks. Each webhook must carry a valid X-Razorpay-Signature made with your webhook secret. Each event ID is used once. Events for another shop on the same site are ignored.
• Secrets stay on the server. The Key Secret and webhook secrets are never sent to the browser. Only the public Key ID is.
• Redacted logs. Keys, secrets, signatures, and card numbers are masked.
• Signed return link. The mobile redirect return link is signed with your site secret.
• Admin refunds. Refund actions need a logged-in administrator with edit rights in the shop, plus the Joomla form token.
• Privacy. Razorpay receives the order amount, currency, order number, and, when available, the customer name, email, and phone so checkout can be prefilled. The plugin does not contact JoomlaX servers except for the normal Joomla update check.

Use HTTPS, keep Joomla, the shop, and this plugin updated, limit who can open the payment settings, and regenerate keys in Razorpay if you think they have leaked.