⚠ A leaked or forwarded invite link lets a stranger join a team and see children's names, pickup stops, and driver schedules.
Mitigation
Use expiring, revocable single-team links with organizer approval for each join; show the roster to members; reveal addresses only 24 hours before a ride to confirmed riders.
⚠ A parent claims many slots, then cancels late, or a bad actor claims a ride to learn when a child will be at a pickup stop.
Mitigation
Show addresses only to the assigned driver and riding families, log all claims and cancellations, alert the organizer on repeated late cancels, and notify guardians of every driver change.
⚠ Group order abuse: an order starter inflates items, adds fake families, or leaves others paying for food never picked up.
Mitigation
Charge each family only for its own items, lock the order at the cutoff, show the final total to everyone, and allow refunds only through the app before the restaurant confirms.
⚠ Calendar sync or export leaks child location and routines through public iCal feeds or shared calendar links.
Mitigation
Use private, per-user tokenized feeds that can be rotated, put no child names or full addresses in event titles, and expire tokens when the user leaves the team.
⚠ Allergy or dietary notes are entered wrongly or exposed, and a restaurant gets bad information, creating a child health risk.
Mitigation
Make allergy notes optional, show them only to the order starter and the restaurant, add a disclaimer to confirm directly with the restaurant, and delete notes after the order closes.