The client-side price vulnerability is the most classic mistake in e-commerce and it's surprisingly easy to ship it to production unnoticed. Good catch.
Curious about your Cloud Function architecture: are you recalculating the cart server-side synchronously during placeOrder, or do you have a separate price validation step before the payment intent is created? The timing matters a lot with Razorpay if you validate after the payment succeeds you're in a tricky refund flow, but if you validate before you have a race condition window where menu prices could change mid-checkout.
The MobX reaction bug is one I've seen cause real support tickets. The boolean guard works, but a cleaner long-term pattern is using reaction() with a fireImmediately: false and disposing it inside the delivery screen's lifecycle prevents the guard from becoming a hidden global state dependency.
How are you handling the background GPS foreground service on iOS? Android foreground services are straightforward, but iOS background location has strict entitlement requirements that Apple often rejects on first review.
