Frontend and backend
Also called Client side and server side
The frontend is the code that runs in the user's browser. The backend is the code that runs on your server. Anyone can read the frontend and change what it sends. Nobody outside can read the backend.
Agents often put a rule where the button is, because that's where the feature is. A check in the frontend is only a courtesy to honest people, so anything that protects money or data has to be repeated on the backend.
Say it to your agent
“Work out the order total on the server from the product ids, and ignore any price the browser sends. Add a test that posts total: 1 and checks the real price is charged. Then grep the build output in dist/ for any secret key.”