Security
How the demo protects an account
Password storage
Passwords are hashed with PHP's password_hash() (bcrypt) — plaintext passwords are never stored or logged.
Two-factor sign-in
Admin sign-in requires a time-limited one-time code in addition to a password.
CSRF & rate limiting
Every form submission carries a per-session CSRF token, and repeated failed sign-ins trigger a temporary lockout.
Audit trail
Administrative actions — creating customers, editing transactions, changing status — are recorded with the acting admin, action, and timestamp.