Checks · PAY-003

PAY-003 · Paid access granted on redirect not webhook

Why it matters

The success page loads whenever someone opens the URL. Payment is confirmed only by the webhook.

How we detect it

The success page sets a paid flag.

How we fix it

Grant access when the payment provider confirms the paid session.

Can it be fixed automatically? With review

Related checks

• PAY-001 · Stripe webhook without signature verification
• PAY-002 · Price or amount taken from client
• PAY-004 · Webhook handler not idempotent
• PAY-005 · Stripe live secret in frontend