Source code
Security & compliance
Client-trusted amount
Part of the Payment safety check · fix arrives as a guide
What it is
The amount, currency, or price is read from the request body and used to create the charge.
Why it matters
Those values came from the browser, which means the customer chose them. Changing a number in devtools changes what they pay, and the transaction is perfectly valid — nothing rejects it.
How to fix it
Send an item or plan identifier from the client and look the price up server-side, or use provider-hosted price objects so the amount never crosses the boundary. Verify the final amount again when the webhook confirms.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.