ShipSafe · Payments

Payments Preflight

15 checks to run before you take money in an app built with Cursor, Claude Code, Lovable or similar. Each page says how to check, how to fix, and gives a prompt for your AI coding tool. Sources are Stripe's docs.

1. Verify every webhook signatureCheck the Stripe-Signature header against the raw body and your whsec_ secret.
2. Handle webhook retries and duplicate eventsStripe retries and can resend an event, so store processed event ids.
3. Handle events that arrive out of orderEvents can arrive in any order, so fetch the current object from the API.
4. Keep test and live keys separatesk_live_ keys belong only in production env vars; webhook secrets differ per mode.
5. Use restricted API keys where you canGive scripts, jobs, AI agents and third-party tools rk_ keys with limited permissions.
6. Never trust prices or amounts from the clientCreate sessions on the server from your own Price IDs, never browser amounts.
7. Have a kill switch for checkoutA flag that stops new checkout sessions, plus Payment Links you can deactivate.
8. Handle failed payments and dunningListen for invoice.payment_failed, enable Smart Retries, decide what past_due keeps.
9. Handle refunds and disputesRemove access when money goes back and see disputes before the response deadline.
10. Keep subscription state in sync with StripeSync customer.subscription.* events into one table and read access only from it.
11. Let customers manage billing safelyCreate portal sessions on the server, only for the signed-in user's customer id.
12. Get tax and receipts basics rightTurn on email receipts and decide on sales tax and VAT before launch.
13. Rate limit checkout session creationCap sessions per user and IP to slow card testing and protect API limits.
14. Log payments without card data or secretsCollect cards with Checkout or Elements and log Stripe ids, not payloads or keys.
15. Test with the Stripe CLI, test cards and test clocksUse stripe listen, stripe trigger, decline and 3D Secure test cards, and test clocks.

Ticks stay in this browser. Not affiliated with Stripe. Written for Stripe, most points apply to any payment provider.

Also see the pre-deploy security checklist: secrets, auth, abuse and deploy settings.

Sponsor this page: get in touch.