Redirects stay on Kumir

redirectFromSearch only allows same-origin paths. No open redirect.

redirect_to and next must start with a single slash. Protocol-relative, external, and @-host tricks fall back to /business/browse.

Native Log in always opens the in-app business catalog after a verified password.