"I've copied purchase button URL and added more custom capabilities and s2Member created new account with all custom capabilities I added``manually""to the purchase URL."
The question is, how to protect ourselves against users who will try the same thing I did?