Stripe Webhooks & Billing Integrity

stripe-billing-integrity · v1.0.0 · paid

Catches the Stripe billing failures that quietly give away paid access: webhook verification that fails open, disabled replay protection, fulfillment that only happens on the success page, out-of-order event overwrites, and test-mode events granting live entitlements.

Webhook Authenticity

webhook-authenticity · weight 0.4 · taxon cryptography-and-secrets

Webhook signature verification is implemented
ab-002262
critical
Stripe webhook signature verification fails closed: a failed or skipped verification never reaches event handling
ab-002648
critical
Stripe webhook replay tolerance is left at the default or set to a bounded value (600 seconds or less)
ab-002649
high

Event Processing

event-processing · weight 0.25 · taxon data-integrity

Webhook handlers are idempotent
ab-000248
critical
Webhook retry handling for payment events
ab-002258
medium
Webhook endpoints return 200 OK quickly before complex processing
ab-001171
low
Stripe event handlers tolerate out-of-order delivery by re-fetching current state or guarding on recency
ab-002650
medium

Entitlement Integrity

entitlement-integrity · weight 0.25 · taxon access-control

Payment amounts sourced server-side, never from client
ab-002622
critical
No way to bypass payment via API
ab-002265
critical
Subscription status is verified server-side
ab-002253
high
Downgrade removes access to premium features
ab-002254
high
Paid access is granted from a verified webhook or a server-side checked session, never from the success page alone
ab-002651
critical

Mode & Key Hygiene

mode-and-key-hygiene · weight 0.1 · taxon cryptography-and-secrets

Secret API keys are not exposed to the client-side bundle
ab-001153
critical
API keys and secrets are loaded exclusively from environment variables
ab-001157
high
Stripe test-mode events cannot grant live entitlements: livemode is checked or test and live use separate endpoints and secrets
ab-002652
high