Afiliate Hack Prevention

I'm building an afiliate vending system for my products and I was wondering about the common hacks and glitches found in a lot of these vending systems.

Currently the system I'm testing out will allow a person to own the vendor as no-mod, no-copy. However it requires manual activation by a trusted member in my group, or myself, before debt permissions will show for the affiliate owner.
I also have it set to delete itself either on rez, and in state entry, if it has already been activated.
This should help with the "double permission" hack and I figured it would help prevent the "buy & delete" issues.
Unless there is something I missed.

The problem with No-copy is that the vendors may be given to another person. But since it will not work until activated, and the fact it will delete if rezed twice after activation, should prevent that from being an issue I would think.
If nessesary i also have the ability to delete the vendor remotly.

I hope I have all the bases covered but it seems there might be something missing?

Thanks for any help.

PERMISSION_DEBIT can be revoked at any time without triggering run_time_permissions, so watch out for that using a timer.

Revoked? Huh. How does that happen?

Revoking... apparently not available with the LL viewer, but it's part of the protocol