Your Stripe Webhook Audit Report

Issue #1 — No Stripe signature verification detected in webhook handler $167/mo risk reduction

import { POST } from "@/modules/ee/billing/api/route";

export { POST };

# Verify the signature BEFORE doing anything else:
sig_header = request.headers.get('Stripe-Signature')
try:
    event = stripe.Webhook.construct_event(
        payload=request.data,
        sig_header=sig_header,
        secret=STRIPE_WEBHOOK_SECRET,
    )
except (stripe.error.SignatureVerificationError, ValueError):
    return Response(status=400)

Issue #2 — Handler missing 3 high-impact event case(s): payment_intent.succeeded, invoice.payment_failed, charge.dispute.created $900/mo risk reduction

const getUnresolvedOrganizationResponse = (event: Stripe.Event) => {
  logger.warn(
    { eventType: event.type, eventId: event.id },
    "Skipping Stripe webhook: organization not resolved"
  );

  if (event.type === "checkout.session.completed") {

if event.type == 'payment_intent.succeeded':
    handle_payment_success(event.data.object)
elif event.type == 'customer.subscription.deleted':
    revoke_entitlements(event.data.object.customer)
elif event.type == 'invoice.payment_failed':
    start_dunning_flow(event.data.object)
elif event.type == 'charge.dispute.created':
    enqueue_dispute_evidence(event.data.object)
else:
    log.info('unhandled event', extra={'type': event.type})

Issue #3 — Webhook handler has no event-id deduplication (idempotency hole) $500/mo risk reduction

const getUnresolvedOrganizationResponse = (event: Stripe.Event) => {
  logger.warn(
    { eventType: event.type, eventId: event.id },
    "Skipping Stripe webhook: organization not resolved"
  );

  if (event.type === "checkout.session.completed") {

# At handler entry, dedupe on event.id:
if processed_events.exists(event_id=event.id):
    return Response(status=200)  # already handled, ack
with db.transaction():
    processed_events.create(event_id=event.id, type=event.type)
    dispatch_event(event)  # safe: only runs once per event.id

Issue #4 — Handler logs full event payload or PII fields without redaction $50/mo risk reduction

const getUnresolvedOrganizationResponse = (event: Stripe.Event) => {
  logger.warn(
    { eventType: event.type, eventId: event.id },
    "Skipping Stripe webhook: organization not resolved"
  );

# Redact before logging:
REDACT_FIELDS = {'email', 'last4', 'name', 'phone', 'address'}
def redact(obj, fields=REDACT_FIELDS):
    if isinstance(obj, dict):
        return {k: ('[REDACTED]' if k in fields else redact(v))
                for k, v in obj.items()}
    if isinstance(obj, list):
        return [redact(x) for x in obj]
    return obj
log.info('stripe event', extra={'event': redact(event.to_dict())})

How we calculate "$/mo risk reduction"

Stripe webhook handler bugs don't generate a recurring monthly bill the way uncached LLM calls do — they generate per-incident costs: chargebacks ($1,500-$3,000 each), lost-dispute defaults ($500-$5,000), double-charged customer refunds + churn ($200-$2,000), PII-leak log-scrubbing ($1,500+).

We translate those into monthly amortized risk reduction using industry-baseline incident rates (e.g., webhook endpoints without signature verification get probed within ~6 months once a URL leaks; Stripe retries every event up to 3 days, so a non-idempotent handler hits a double-execution incident roughly once per quarter at moderate volume). The figure is a planning aid, not a bill-cut prediction. If your incident rate is higher than baseline, your actual savings are higher.

30-day re-audit voucher

Why this matters: static analysis is only valuable if the fixes ship. The re-audit voucher creates an accountability loop — we can't claim "issue resolved" unless the v1 ruleset agrees on re-scan. Same deterministic engine, same file paths, same line numbers. No moving goalposts.