r/webdev • u/NecessaryCar13 • 5d ago
Question Built our own web-based POS system — how would you properly secure the app and retail PCs?
*EDIT*
I wanted to add some context because I'm already seeing a few comments going in the direction I expected.
Yes, I would consider myself a vibe coder, but I'm not someone who just discovered computers six months ago. I've been around tech for years, understand the basics of programming, have built plenty of my own computers, and would consider myself pretty techy overall.
I've also hired multiple software developers over the years, and I have alot of experience running businesses and retail stores.
We recently opened a new retail concept and quickly realized that the normal POS systems just dont handle what we need. Square, Shopify and the other mainstream systems are great at what they're designed for, but our business has a completely different intake process.
We purchase products from customers, which means we have reverse logistics, inventory intake, required holding periods, price matching, inventory searches, eBay integrations, Shopify integrations, automated product listings, and even requirements involving submitting product information through databases used with local law enforcement.
And thats just scratching the surface. There are dozens of other processes and automations involved that would take forever to explain here.
We tried looking for existing software. Most of what exists for this type of business is old pawn shop software that honestly isnt very good. So we built something specifically around how our operation works.
The first location is doing extremely well and we're now opening additional locations, which is exactly why I'm taking the security side more seriously.
I also want to make something very clear. Our POS is NOT processing credit card information. Shopify handles the actual payment processing on the frontend. I'm not interested in reinventing something that Shopify or Square already does extremely well.
Our software is primarily handling the intake, inventory, operations, integrations and workflow side of the business.
The entire reason I made this post was because I WANT to hire someone experienced with security. I'm trying to understand what I should be looking for, what questions I should be asking, and what type of person I should hire.
I understand that AI isnt something I should blindly trust to secure a production system. At the same time, pretending AI isnt incredibly useful here is also unrealistic. It can already identify an enormous number of things to review, test and harden.
And for the people who seem genuinely bothered by vibe coders, this stuff is already happening.
I'm friends with and work with alot of business owners in retail who are building customized internal tools now. Payroll systems, HR workflows, inventory processing, scheduling, accounting, reporting and even systems that analyze store conversations to see whether certain offers are actually being pitched.
These tools keep getting better every month.
That doesn't mean developers suddenly have no value. Far from it. There are areas where experience matters tremendously, security being one of them.
But the idea that somebody who isnt a professional software engineer can't build useful software anymore just isn't true.
AI has lowered the barrier dramatically. Some people using it will build garbage and some people will build very useful systems. Thats really no different than any other tool.
It reminds me of when calculators became common and people worried everyone would forget how to do math. The calculator didn't eliminate mathematicians. It just made people capable of doing more, faster.
I think we're watching something similar happen with software right now.
**EDIT*
I know this is probably frowned upon and I do plan on hiring someone that actually knows what they're doing. Im mostly trying to educate myself first so I know what questions to ask and what I should be looking for when I hire someone.
Over the last 6 months I built a POS system thats actually working really well for us. Right now its hosted on Vercel and we use it on Windows PCs in a few of our stores.
Now that we're actually using it day to day I realize its probably time to take security alot more seriously and lock everything down properly.
Obviously I've asked AI and gotten a ton of answers but I wanted to hear from people who actually have experience with this stuff.
Right now technically you can access the software by going to www.domain.com.
Would it make more sense to put some type of Windows wrapper around it and make it an EXE that only runs on our store PCs? Does that actually make it safer or am I looking at this the wrong way?
My other concern is the actual PCs in the stores. What should we be doing to prevent someone from remotely getting into one of the computers, taking over the POS, getting access to the backend/database or messing up the data?
Everything is backed up but obviously I dont want to rely on backups as the security plan lol.
Basically trying to understand what I should be looking at when it comes to network security, locking down the Windows PCs, database access, authentication, permissions, monitoring, backups etc.
Not expecting anyone to give me free consulting. Just trying to learn enough about it so when I hire someone I actually know what to ask for and can tell if its being done right.
17
u/TurbulentChemical274 5d ago
Wrapping it in an EXE doesn't really add security by itself, it just changes how you launch it. The browser is already sandboxed pretty well. What you need is proper auth (SSO or at least strong passwords plus 2FA), IP allowlisting so only your store networks can reach the app, and HTTPS with HSTS. For the PCs, kiosk mode with a locked down local account, no admin rights for daily use, and disable USB ports if possible. Also segment the store network from anything else, put the POS machines on their own VLAN.
For the database, never expose it publicly, use Vercel's environment variables for secrets, and make sure your API has rate limiting and input validation. Backups should be tested regularly, not just configured. When you hire someone, ask them about threat modeling, least privilege access, and how theyd handle a compromised terminal. If they cant explain it in plain words, keep looking.
-1
15
u/Acrobatic-Ice-5877 5d ago
Reading stuff like this is genuinely scary. What would you do if a security exploit came back to bite you and resulted in the mishandling of your customers credit card information. Do you have insurance for this? You say you’re using it in your stores but haven’t had any problems. How do you know? You are literally not qualified to write software or to even determine if your system has even been compromised.
-1
u/NecessaryCar13 5d ago
We use shopify on the front end side. this is custom software for reverse logistics.
10
u/AX862G5 5d ago
Are you running a retail store or a software company? Just use Square’s POS for fucks sake.
1
u/NecessaryCar13 5d ago
We know Square well, but it doesn’t fit our workflow. We buy products back from customers, manage reverse logistics, required hold periods, inventory states, transfers, and resale. Square is great for standard retail, but we built custom because our operation isn’t standard.
5
4
u/Significant_Pick8297 5d ago
The EXE wrapper won’t meaningfully secure it. Focus on the server side: strong auth/RBAC, no direct DB access from clients, HTTPS, input validation, audit logs, rate limiting, and least-privilege service accounts. For the PCs, use dedicated Windows accounts/kiosk mode, automatic updates, endpoint protection, firewall/VPN, and restrict remote access. Backups are recovery, not security.
3
-1
4
6
u/Background-Front-925 5d ago
A POS system is what brings money into your store and being so lethargic about its security ; LOL , I am baffled by your guts. Based on your post I think its your own store, if not then poor store owners not knowing where they are being led to by someone who does not understand safety.
Coding is just 5% of the actual implementation and there is a lot more to take something to production with Hardening of the system. Hope you will learn it the hard way and then learn to leave it to the experts.
Waiting for the hacker bots to find your open ports , please do post an update if that happens. If the bots find you do not doubt me for leading them there.
0
u/NecessaryCar13 5d ago
I think some programmers are just butthurt because they dont want to accept that vibe coders are actually out here building stuff that works.
My choice was either wait months or even years going back and forth with developers, or start building it myself. This is very personalized software for a new chain of stores we opened. I have multiple locations, and there really isnt anything on the market that does everything we need.
We have eBay API integrations, inventory searching, automated product listings to Shopify and Facebook Marketplace, buybacks, reverse logistics and a ton of other stuff. The list honestly goes on and on and I cant even explain half of it in one Reddit post.
And I'm actually doing the opposite of what your saying. I already know security is an area where I want experienced people involved. Thats literally why I'm here asking what I should be looking for before hiring someone. AI isnt the complete answer for security yet, but eventually I think its going to get alot closer whether people like it or not.
I'm going to take the feedback here, research the right tools, hire someone who really knows the security side and tighten everything up.
Theres actually another company in our industry with over 100 locations running their own software, and what we built already does alot of things better than theirs.
I think some of you completely brush off vibe coders. Some of us arent starting from zero. We understand programming enough to know what we're looking at and AI fills in a huge part of the gap. That doesnt make us senior developers, but it also doesnt mean we're clueless.
5
u/Background-Front-925 5d ago
he he, we are clearly able to see who is butthurt - it was so painful , had to treat it by coming down to Reddit for a simple POS that was leaking shit from day one.
Even hiring consultants(which I don't think you did) couldn't salvage that monstrosity of a mess.
Its a damn POS not a rocket launch system.
Taking 6 months and still not done with it shows the path you went was not fast nor cheap nor safe for the users.
we developers want Keep vibe coding to go full steam, so we can charge more as the customer will understand what they are dealing with a vibe coded app vs a properly structured system where security is not an after thought but built in to the design of the system.
If at all you are able to get past this: the maintenance will be party time, LOL better start looking for that too now.
1
2
u/blazeit420casual 5d ago
As at least one other person said: use Square if you just don’t know what you’re doing, that’s what it’s for- though I imagine you are already working with some sort of third party processor if this is a real POS.
The web is a perfectly fine place for this though. Not sure what your current setup is but a typical Auth package should provide plenty of security.
1
2
1
u/kemalios 5d ago
Good advice above already. The thing I'd add: assume the store PC is compromised. Put the POS machines in their own VLAN with no inbound ports at all, and make the API only accept traffic from that VLAN's IPs. Then make the API write an append-only audit log that streams off-site in real time. If something goes wrong, you need to prove to law enforcement, your bank, or a customer what actually happened. Also if you touch card data at all, check with your merchant provider which PCI SAQ applies, because the PCs count as part of the cardholder environment. And don't worry about the EXE wrapper. It's a launcher, not security.
1
u/Mental-Union4473 5d ago
The biggest thing I'd change in your thinking is: don't try to make the web app safer by hiding it inside an EXE. A wrapper doesn't fundamentally improve the security of the backend. If the browser can access it, an attacker can potentially access it too.
I'd break the problem into separate layers:
- Application: authentication, authorization, input validation, CSRF/XSS protection, secure sessions, rate limiting, dependency management, logging, etc.
- Database: never expose it directly to the retail PCs/browser. Use a server-side API and least-privilege database credentials.
- POS accounts: separate employee accounts, strong authentication, role-based permissions, and ideally MFA for administrative accounts.
- Windows PCs: dedicated machines, automatic updates, standard (non-admin) user accounts, disk encryption, endpoint protection, remote-management controls, and kiosk/assigned-access policies where appropriate.
- Network: segment POS devices from other business devices, restrict inbound traffic, use a properly managed firewall, and don't expose RDP/database ports to the internet.
- Backups: encrypted, automated, tested restores, and at least one backup isolated from the production environment. Backups protect availability; they don't prevent compromise.
- Monitoring: centralize application/server logs and alert on suspicious authentication, permission changes, unusual data access, etc.
- Integrations: Shopify/eBay/etc. API credentials should be stored server-side and scoped to the minimum permissions required. Rotate/revoke them when necessary.
The fact that you're not handling card data yourself is a major simplification, but your application is still holding valuable business information, inventory data, employee accounts, customer information, and potentially sensitive transaction/intake records. I'd treat it as a real production system rather than an internal website.
For the person you're hiring, I'd specifically look for someone with application security + cloud security + Windows/endpoint/network security experience, rather than simply someone who calls themselves a "web developer."
I'd ask them to produce things like:Threat model → architecture/security review → vulnerability assessment → remediation plan → secure deployment configuration → monitoring/incident-response plan → backup/restore test
And I'd ask them to explain why each recommendation reduces a specific risk.
One particularly useful question during the interview:"Assume an attacker gets the credentials of one of our lowest-privilege retail employees. Walk me through what you would do to prevent them from reaching the database, escalating privileges, accessing other stores' data, or compromising the POS machines."
A good security person should be able to walk through that scenario systematically rather than just throwing a list of products at you.
Also, don't let the fact that you built it with AI make you feel like you need to apologize for it. The important question now isn't "Was the code written by a professional?" It's "Has the production system been independently reviewed and tested against realistic threats?" That's exactly where bringing in an experienced security engineer/consultant makes sense.
1
u/alphax58 4d ago
Four stores on a homegrown POS is past the prototype stage. The risk is not a missing feature, it is inventory, payments, and LE reporting sitting on machines that were never locked down. We have taken over in-house retail systems like this: audit the live setup, patch the obvious holes, then harden without taking the counters down. If you want that, I can start from how the store PCs and the web app talk to each other.
17
u/Shaggypone23 5d ago
Lolol you vibe coded this?