Catches the Stripe billing failures that quietly give away paid access: webhook verification that fails open, disabled replay protection, fulfillment that only happens on the success page, out-of-order event overwrites, and test-mode events granting live entitlements.
This audit looks at how your app turns Stripe events into paid access. It is built for projects that take payments through Stripe Checkout, subscriptions, or invoices, and it focuses on the failures AI-generated billing code tends to ship with. Webhook authenticity covers verification that is skipped when a secret is unset, swallowed errors that fall through to handling, and replay protection that was switched off to silence a timestamp error. Event processing covers idempotency, retries, quick acknowledgement, and handlers that overwrite newer subscription state with a late-arriving event. Entitlement integrity covers server-side amounts, payment bypass routes, and the most common bug of all, granting access from the success page instead of a verified webhook. Mode and key hygiene covers secret keys in client bundles and test-mode events being accepted by production. It skips cleanly when the project has no Stripe dependency and no Stripe environment variables.
15
Total Checks
3
Delivery Formats
5
Categories
1
Versions
Included
Never included
Initial release. Stripe-specific audit of how webhook events become paid access, in four sections: webhook authenticity, event processing, entitlement integrity, and mode and key hygiene. Reuses ten existing patterns (signature verification, idempotency, retries, server-side amounts, payment bypass, server-verified subscriptions, downgrade, secret-key hygiene) and adds five new ones: verification that fails closed, replay tolerance not disabled, out-of-order event tolerance, fulfillment through a verified webhook path, and test events not granting live entitlements. No severity changed on any existing pattern.
Picked by pack overlap with this audit.
API design quality assessment covering naming consistency, HTTP semantics, request/response shape, security controls, and developer experience.
Comprehensive security audit for REST and GraphQL APIs, covering authentication, authorization, input validation, and protection against OWASP API Top 10 threats.
Production-ready authentication assessment covering session management, login flow security, password handling, and OAuth integrations.
Authorization layer assessment covering access control, resource authorization, API permissions, and admin boundary enforcement.
Secure payment and billing assessment covering payment security, subscription management, pricing enforcement, and customer billing experience.