Payments and entitlements
Handler assumes events arrive in order
The code expects subscription.created before invoice.paid, and leaves the account in the wrong state when they arrive reversed.
Termswebhook (a message a provider such as Stripe sends to your server when something happens, like a payment) · raw body (the request bytes exactly as sent; signature checks fail if a framework parses them first) · idempotency key (an identifier stored per processed event so a duplicate delivery changes nothing) · publishable and secret keys (the publishable key may sit in the browser because row-level security limits it; the secret key bypasses those rules and must stay on the server)
highseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
Stripe does not guarantee delivery order. Handlers written from a happy-path example encode the order the example showed.
Stripe signs every webhook event; without verification an attacker could send fake events to trigger order fulfilment or grant access. Official libraries reject events older than 5 minutes by default, endpoints may receive the same event more than once, and Stripe does not promise delivery order.
Source: Stripe docs, 2026-09 · verified 2026-09-21
How we detect it
Deliver a pair of related events in reverse and check the final state.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Stacks: Stripe
Checklist items that catch it
Duplicate and out-of-order events are handled once
automated Deliver the same event id twice and deliver invoice.paid before customer.subscription.created.
Exactly one state change per event id; the out-of-order pair ends in the correct final state.
Cancellation, downgrade and refund paths update entitlements
manual Trigger cancel, downgrade, failed renewal and refund events in the payment provider's test mode and check the account state.
Each event leaves the account with the entitlement the written rules specify, within one webhook delivery.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
More in payments and entitlements
- critical
- critical
- critical
- high
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.