Glossary
Entitlement
The record that says this account paid for this thing.
What it means
An entitlement is the row that connects a customer to something they bought. Not the charge, not the receipt, the access itself. It is what your app reads when it decides whether to show the paid page.
Three things go wrong with it. It is granted by the browser instead of the server, so anyone can grant themselves one. It is granted more than once because the payment webhook retried. It is never revoked after a refund, so access outlives the money.
The safe shape is small: written only by server code, after a verified payment event, keyed so a repeat is impossible, and readable only by its owner. None of that is visible from a URL, which is why payment handling stays on the not-verified list.
Incidents where it mattered
No incident in the library maps to this one yet.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026