Limitations
What does not work yet
- No online payments or billing. Companies arrange payment themselves. Plans exist in the data model, but the trial is only recorded.
- The stock check is not atomic. Simultaneous confirmations for the last units can both pass.
- Availability ignores dates. Ready units are counted for right now, so confirming a booking for next month already reduces what can be confirmed today.
- Times are UTC and reservations are whole days. Company time zones are stored but not applied.
- No image uploads. Item images and file custom fields take URLs.
- No rate limits on sign-in and booking requests apart from a honeypot field.
- Unknown company names return status 200 with a noindex "not found" page instead of a real 404.
- Not translated yet. Locale is stored in settings; the interface is in English.
- Field-level restrictions per member can be stored but are not enforced.
- Booking emails are not verified; a request can be sent with any address.
- Isolation is in the application, not Postgres row-level security.