SniffPupPayments Doctor
Paste your Stripe checkout, success page and webhook code. You get a list of common payment mistakes, why each matters, how to fix it, and a prompt you can paste into Lovable, Cursor, Bolt or Claude Code.
You can paste several files at once. A line with the file name (like // app/api/webhook/route.ts) above each file helps.
🔒 What you paste is checked in memory on our server for this one response. It isn't stored, logged or used for training, and secrets in the results are masked. Nothing is sent to Stripe. Please don't paste live secret keys; if one is in your code, roll it in the Stripe Dashboard.
What the quick check looks for
- Access granted on the success page. Anyone can open that page, so access should come from a signed webhook.
- Webhook signature not checked. Without it, anyone can send your webhook a fake “payment succeeded” event.
- No protection against retries. Stripe can send the same event more than once, which can add credits twice. Charges created without an idempotency key can also repeat.
- Refunds and disputes don't remove access.
- A Stripe secret key in code or in a browser-visible variable.
What the full check adds
Part of the Solo, Starter and Pro plans. See plans.
- The webhook reads parsed JSON instead of the raw body, so signature checks fail.
- Checkout completed without checking
payment_status(delayed payment methods). - Subscriptions that end or fail to renew don't remove access.
- Prices or amounts taken from the browser.
- A webhook signing secret written into the code.
- A re-check after you change your code, marking each earlier finding fixed or still there.
What it can't see
- Only the text you paste. It doesn't connect to your Stripe account, your database or your live app.
- Settings in the Stripe Dashboard, like which events your webhook endpoint is subscribed to.
- Whether your code actually runs the way it reads. It uses patterns, so it can miss problems or flag code that is fine.
- Taxes, invoices, payouts, Connect and other Stripe products beyond checkout, subscriptions, webhooks, refunds and disputes.
Questions
Do you keep my code?
What you paste is checked in memory on our server for this one response. It isn't stored, logged or used for training, and secrets in the results are masked. Nothing is sent to Stripe. Don't paste live secret keys. If one is in your code, roll it in the Stripe Dashboard.
Does it work with my stack?
It reads JavaScript and TypeScript (Next.js, Express, Supabase Edge Functions), plus common Python, Ruby and PHP Stripe code. Paste each file under a line with its file name for the best results.
A clean result: am I done?
Not necessarily. These rules read code, not your running app. Test a purchase, a refund and a cancellation in Stripe test mode, and use the Stripe CLI to resend the same event twice.
Is the quick check really free?
Yes. No account is needed. It's limited to a number of checks per hour per network to keep it running for everyone.
All Sniff & Fix checks · Free security scan of your live app