Passwords are stored as scrypt hashes. The session cookie cannot be read by the page. Asking for someone else's order number returns nothing.
Sample login, not a customer
Email desk@transmaritime.uk
Password Thetford-1972
The three shipments inside are examples. Set PORTAL_SEED_PASSWORD and delete .data/portal.json before this desk holds real freight. That hides this box.