Source code
Security & compliance
Stability
Client-success fulfillment
Part of the Payment safety check · fix arrives as a guide
What it is
Fulfilment is triggered by the client-side success callback or redirect rather than by the provider's webhook.
Why it matters
The client callback means the browser reached the success page, which is neither necessary nor sufficient for the payment having settled. A user who closes the tab pays and gets nothing; one who fabricates the callback gets it for free.
How to fix it
Treat the client redirect as a UI event only. Fulfil on the verified webhook, and have the success page poll your own backend for the state your webhook handler recorded.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.