Source code
Security & compliance
Stability
Payment safety
Money-moving code, read the way an auditor would read it.
Overview
Runs when the repo integrates Stripe or another payments provider. lumioguard reads checkout, webhook, and subscription paths for the defects that let a charge double, a webhook be forged, or an amount be set by the browser.
What it looks for
- Webhook handlers that never verify the provider signature against the raw body
- No idempotency key on charge or subscription creation
- Amounts and currency taken from the client instead of a server-side price
- Secret keys reachable from client-side code
- Card data touching your servers, unhandled failures and disputes, fulfilment triggered by a client success callback
Why it matters
A webhook handler that skips signature verification will accept a payment_succeeded from anyone who finds the URL. An amount read from the request body is an amount the customer chose. Neither throws an error; both show up in reconciliation.
Rules in this check
| What it reports | Fix path |
|---|---|
| Unverified webhook | Guide |
| Missing idempotency | Guide |
| Client-trusted amount | Guide |
| Secret-key exposure | Guide |
| PCI/card-data handling | Guide |
| Unhandled failure/dispute | Guide |
| Client-success fulfillment | Guide |
How the fixes arrive
GuideChanges only you can make safely arrive as a step-by-step guide you can follow yourself or hand to your coding agent.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.