Line 34: `@app.route('/api/orders/<id>')` has no @login_required or ownership check before returning Order.query.get(id) — any user can fetch any order by guessing IDs. This is a security issue, not a style note — flag as blocking. Line 51: db.session.commit() is called before the associated Stripe charge is confirmed — if the charge fails after this line, the order is already marked paid in the database. Unhandled edge case: partial failure between DB write and payment confirmation. No logic bugs found in the discount calculation itself (lines 60-72) — the math checks out for the cases shown.