Not verified
Payment handling
Whether payment events are verified, replay safe, and matched to the right customer record.
Last updated September 20, 2026
Needs the code
Why a check from outside cannot see it
Payment handling lives in a webhook endpoint that only your provider is supposed to call. Reaching it from outside would mean forging a request, which is exactly what should fail.
How to check it yourself
- 1Take a real payment event from your provider's dashboard.
- 2Replay it twice to your endpoint.
- 3Check the customer has exactly one entitlement and one record, then remove the signature and confirm the second attempt is refused.
Replay a payment webhook twice and confirm the customer is only granted access once.
What a Launch Review does instead
Launch Review, $199
A reviewer replays a payment event twice and confirms the customer is granted access exactly once.
See what a Launch Review coversIncidents that involved this
No incident in the library maps to this one yet.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026