Fix Snyk security findings: XSS, open redirect, hardcoded secrets, cookie security, MD5 replacement

src/app/shop/topup/TopUpForm.tsx

@@ -46,6 +46,9 @@ export default function TopUpForm({
       if (redirectUrl.protocol !== "https:") {
         throw new Error("Invalid redirect URL: must be HTTPS");
       }
+      if (!redirectUrl.hostname.endsWith(".paypal.com") && redirectUrl.hostname !== "paypal.com") {
+        throw new Error("Invalid redirect URL: must be a PayPal domain");
+      }
       window.location.href = redirectUrl.href;
     } catch {
       setError("Network error — please try again.");