A critical business logic concern: can a customer on one merchant's store access or affect another merchant's store data? - Can a merchant's storefront customization (JavaScript, CSS) be used to attack customers of other merchants on the platform?