Skip to content
SlashClone
DiscoverUse in ClaudeSubmit a link
Sign in
Made by@shipcheck

Stripe webhook hardening

@shipcheck/stripe-webhook-hardening

Find your Stripe webhook handlers and harden them: verify the Stripe-Signature header, use the raw body, keep the signing secret in env, process each event once, reject bad signatures with 400, and fulfill orders from the webhook rather than the success page. Reads your code and proposes diffs; never calls Stripe.

SkillDevOpsv1.0.0 (latest)Tested
Use in Claude Save Like Clone Comment
Activity
New: be the first to try it
  1. 1# Stripe webhook hardening
  2. 2
  3. 3Finds your Stripe webhook handlers and checks the things that let people fake payments or get credited twice. Then it proposes small diffs for your framework, one at a time.
  4. 4
  5. 5**For:** anyone who added Stripe Checkout or subscriptions to an app, especially with a coding agent's help.
  6. 6
  7. 7## Example
  8. 8
  9. 9Input: a Next.js route that does `const event = await req.json()` and marks the order paid.
  10. 10
  11. 11Output (`out/webhook-scan.md`):
  12. 12
  13. 13```markdown
  14. 14Handlers found: 1 | High: 2 | Medium: 1 | Low: 0
  15. 15
  16. 16## app/api/webhooks/stripe/route.ts
  17. 17| Check | Result | Note |
  18. 18| signature | FAIL (high) | Anyone who finds this URL can post a fake |
  19. 19| | | checkout.session.completed. |
  20. 20| raw-body | FAIL (high) | Reads the body as parsed JSON. |
  21. 21| idempotency | FAIL (medium) | Retries can double up orders or credits. |
  22. 22```
  23. 23
  24. 24Then Claude reads the handler in full, checks things a scan cannot (like access granted on the success page), and shows a diff for each fix. Try it on the bundled example: `node scripts/webhook-scan.mjs examples/project`.
  25. 25
  26. 26## What it checks
  27. 27
  28. 28Signature verification, raw body, signing secret in env, idempotency on `event.id`, 400 on bad signatures, event type filtering, edge runtime support, and fulfillment from the webhook rather than the success page. Works best with Node (Next.js, Express, Supabase Edge Functions); Python, Ruby, Go and PHP handlers are detected with lighter checks.
  29. 29
  30. 30## What it can access
  31. 31
  32. 32- Reads your project's code. Writes the report to `out/`.
  33. 33- Edits handler files in `app/`, `src/`, `pages/`, `server/`, `api/`, or `supabase/functions/`, and adds a migration, only after you say yes to each diff.
  34. 34- No network. It never calls Stripe and needs no keys.
  35. 35
  36. 36## Setup
  37. 37
  38. 38None. Needs Node 22 or later. The Stripe CLI is handy for testing your fixes but not required.
Sign in to comment on a line