Checks · PAY-004

PAY-004 · Webhook handler not idempotent

Why it matters

Stripe retries events. Handling the same event twice can grant access or ship goods twice.

How we detect it

The handler does not store the event id.

How we fix it

Store processed event ids and skip ones you have already handled.

Can it be fixed automatically? Yes, with a template change

Related checks

• PAY-001 · Stripe webhook without signature verification
• PAY-002 · Price or amount taken from client
• PAY-003 · Paid access granted on redirect not webhook
• PAY-005 · Stripe live secret in frontend