Discount codes and exports are harder to misuse

Discount codes can't be guessed at checkout anymore, personal codes follow the customer's account, and your exports never run a formula someone typed.

Guessing codes is held back. After 10 codes that don't work, a visitor waits a few minutes before trying another. A code that doesn't exist and a code that belongs to someone else get the same answer: "This discount code is not valid."
Personal codes follow the account. A signed-in customer gets a code made for their email only when it is their account's email. A guest still gets it by typing that email at checkout.
Exports stay text. In the order, customer and invoice exports, a name, address or phone number that starts with =, +, - or @ gets a ' in front, so your spreadsheet shows it instead of running it as a formula. A phone number like +31 6... shows as '+31 6....
"Max per customer" holds when the same customer checks out in two tabs at once.