Payments and entitlements
Plan limits enforced only in the UI
The app hides premium features from free users while the API serves them to any caller.
Termswebhook (a message a provider such as Stripe sends to your server when something happens, like a payment) · raw body (the request bytes exactly as sent; signature checks fail if a framework parses them first) · idempotency key (an identifier stored per processed event so a duplicate delivery changes nothing) · publishable and secret keys (the publishable key may sit in the browser because row-level security limits it; the secret key bypasses those rules and must stay on the server)
criticalseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
Gating a button is one line; gating the server path needs the plan stored and checked on every call. Stripe's warning about fake events granting access applies equally to a client flag.
Stripe signs every webhook event; without verification an attacker could send fake events to trigger order fulfilment or grant access. Official libraries reject events older than 5 minutes by default, endpoints may receive the same event more than once, and Stripe does not promise delivery order.
Source: Stripe docs, 2026-09 · verified 2026-09-21
An exported Server Action is reachable by direct POST request even when not used in the UI; a page-level authentication check does not extend to the Server Actions defined within it; environment variables prefixed NEXT_PUBLIC_ are exposed to the client.
Source: Next.js docs, 2026-08-25 · verified 2026-09-21
How we detect it
Edit the client-side plan flag or call the gated endpoint directly with a free account.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Checklist items that catch it
Plan and entitlement are enforced on the server
automated Call a gated feature with the client-side plan flag edited to a higher tier and with an expired subscription.
The server refuses the gated feature in both cases.
Cancellation, downgrade and refund paths update entitlements
manual Trigger cancel, downgrade, failed renewal and refund events in the payment provider's test mode and check the account state.
Each event leaves the account with the entitlement the written rules specify, within one webhook delivery.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
More in payments and entitlements
- critical
- critical
- high
- high
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.