Payments and entitlements
Price or amount taken from the request
The checkout call charges whatever amount the browser sent.
Termswebhook (a message a provider such as Stripe sends to your server when something happens, like a payment) · raw body (the request bytes exactly as sent; signature checks fail if a framework parses them first) · idempotency key (an identifier stored per processed event so a duplicate delivery changes nothing) · publishable and secret keys (the publishable key may sit in the browser because row-level security limits it; the secret key bypasses those rules and must stay on the server)
criticalseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
The Next.js guide states client input can be freely modified and must be validated; a checkout sample that passes amount through is the shortest working version.
An exported Server Action is reachable by direct POST request even when not used in the UI; a page-level authentication check does not extend to the Server Actions defined within it; environment variables prefixed NEXT_PUBLIC_ are exposed to the client.
Source: Next.js docs, 2026-08-25 · verified 2026-09-21
Stripe signs every webhook event; without verification an attacker could send fake events to trigger order fulfilment or grant access. Official libraries reject events older than 5 minutes by default, endpoints may receive the same event more than once, and Stripe does not promise delivery order.
Source: Stripe docs, 2026-09 · verified 2026-09-21
How we detect it
Change the amount, currency or quantity in the request and complete checkout.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Checklist items that catch it
Amounts, prices and quantities originate on the server
automated Alter the amount, currency, price id or quantity in the checkout request.
The altered request is rejected or the server recomputes the amount from its own price table.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
More in payments and entitlements
- critical
- critical
- high
- high
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.