Written for anyone about to take payments.
Ordered by what a stranger reaches first. Each links to a self-check you can do today and to what our test adds.
Anyone who finds the webhook URL can post a made-up payment-succeeded event and get an order fulfilled or a plan activated for a user of their choosing, without paying.
A buyer can edit the request in their browser, pay one cent for the top plan, and your app records it as a full purchase.
Anyone can type one line in the browser console to become a paying customer, and the server hands over the paid feature without checking.
A customer is charged twice after a network hiccup, or a replayed webhook tops up an account again and again for a single payment.
Customers can pay with Stripe's published test card numbers, the app fulfils the order, and no money ever reaches your account.
Anyone who calls the API directly, or edits the page in developer tools, gets the data and actions the screen was hiding.
A script can hit the route in a loop overnight and the bill lands on your card, or the provider pauses your account mid-day when its own cap trips and every user sees errors.
Anyone who views the page source can copy the key and run their own workloads on your account until the bill or the provider stops them.
Two days after launching a SaaS built with a coding agent, its founder reported that people were bypassing the subscription and running up usage on the app's API keys (Leo (Enrichlead founder), 2025). The check that would have found it: sign in with a free test account, try to call the paid feature's endpoint directly, and read the JavaScript bundle for keys. Both are in the first patterns below.
Two days after announcing a SaaS built with Cursor and no hand-written code, its founder reported subscription bypasses, maxed-out API keys and unwanted database writes; he shut the app down three days later.
Mar 2025 · Leo (Enrichlead founder) · all sources
For anyone about to switch Stripe to live mode.
$390
For anyone who wants the three riskiest areas checked fast.
$290
Compare all packages, or run the self-check first.
Six things. Webhook signature verified on the server. Price and plan taken from your database, not the browser. Subscription status read from Stripe events, not local storage. Idempotency keys on payment handlers. Live keys only in server environment variables. A spend cap on any model API you pay for. Then switch keys, never both at once.
If the plan check runs only in the browser, yes: a free user can call the paid endpoint directly. Try it yourself with a free test account and the network tab open. Move the check to the server and read the plan from your database.
Post an event with no Stripe-Signature header: a correct handler rejects it. Replay a real event twice: nothing should double. Both tests take a minute with the Stripe CLI; the ready-to-charge check runs them and reports the exact request and response.
Other moments: before you launch, before an investor or security review, before a client handover, after something went wrong, you received a security email.