Three checks you can run on your own app.

Two minutes

Can one account open another's data?

In a sample shop, any new account could read guests' names and addresses by order number.

The full story of this one →

• Make two accounts, A and B. As A, create something private: an order, an invoice, a booking. As B, open it by its address or number. It should be refused.
• Now do the same with a record that has no owner, such as an order placed without signing in or a draft. Open it as B, and again signed out.
• If the numbers in the address run in sequence, try a few next to yours.
• If anything opens, ask whoever built the app one question: "Which functions or server routes read data with full rights, and what does each do when the owner field is empty?"

Five minutes

Can a refund be larger than the order?

In the same shop, €500 could be recorded as refunded on a €29.99 order, and the customer was emailed about it.

The full story of this one →

• Find every place a refund gets recorded: an admin page, a "mark as refunded" button, the handler for Stripe's charge.refunded event, an automation that writes refunds to a sheet.
• Type an amount larger than the order. Is it refused before it is saved, or only by a message in the page?
• Make two partial refunds on one order that together come to more than was paid.
• Open the refund form in two tabs and submit both at once.
• After each try, look at three things: the order, the month's refund figure, and the email the customer got.

About an hour

Does the plan in the app match Stripe?

In a sample portal, a plan given free, a suspension, a handover and a half-finished deletion all left the card paying.

The full story of this one →

• Write down every way a plan can change in your app apart from buying and cancelling. Think of an admin page, a plan given for free, a coupon, a suspension or a ban, moving the account to someone else, deleting it, and anything your support team can do.
• In test mode, do each of them to an account that pays. Then open that customer in the Stripe dashboard. If your app says Free, suspended or deleted and Stripe still shows a next payment date, that card will be charged.
• To see the renewal itself without waiting a month, Stripe's test clocks move a test subscription forward in time.
• Try to leave as the customer in every state: suspended, just after a handover, and on an account bigger than your free plan. Can they cancel from the app? Does Stripe's billing page let them?
• If someone else wrote the code, ask them one question: "List every place that changes the plan, and for each, what happens to the Stripe subscription." An answer like "nothing" for any of them is the hole.