Free / VS Code extension
Catch Stripe bugs before you ship, not after a customer emails you.
Catches the Stripe webhook and checkout bugs that quietly cost real revenue -- flagged in your editor as you type. No live key, no account, no network call. Checks webhook signature verification, event-type coverage, the subscription.updated vs .deleted trap, checkout metadata, and customer-creation timing.
Install (no Marketplace account needed)
- Download stripe-checkup-0.1.0.vsix
- In VS Code, open the Extensions view (Ctrl+Shift+X / Cmd+Shift+X)
- Click the "..." menu at the top of the Extensions view
- Choose "Install from VSIX..." and select the downloaded file
It scans on file open and save, or run "Stripe Checkup: Scan Workspace for Stripe Integration Bugs" from the command palette to check everything at once.
Checks your actual Stripe account, not just source code -- webhook delivery history, stuck subscriptions, bare payment links, key permissions.
The bug this catches most often
Dunning marks a subscription past_due or unpaid by firing customer.subscription.updated, not .deleted. A webhook handler that only reacts to cancellation leaves non-paying customers with paid access indefinitely -- quietly, for as long as nobody notices. This extension flags it the moment you open the file.
Frequently asked
Why isn't this on the VS Code Marketplace yet?
It's the same extension, just installed manually for now instead of via the Marketplace search box. The .vsix below is the exact package that will eventually ship there -- installing it today gets you the same checks with one extra click.
Is this safe to install from a file instead of the Marketplace?
The source for every check is in the README below and is plain, dependency-free JavaScript -- read it before you trust it. It runs entirely in the extension host process against files already open in your editor: no network call, no telemetry, nothing leaves your machine.
What does it actually check?
Five patterns that cause real production bugs: missing webhook signature verification, missing event-type handlers (checkout.session.completed, customer.subscription.updated/.deleted, invoice.payment_failed/.paid), reacting to subscription cancellation but not to the far more common past_due/unpaid update, checkout sessions created without metadata or client_reference_id, and creating a fresh Stripe Customer on every checkout instead of once at signup.
What's the difference between this and the $49 audit?
This is a free, static, in-editor layer that pattern-matches your source code. The one-time audit at stripecheckup.vercel.app goes further: it checks your actual live Stripe account (webhook delivery history vs. subscribed events, stuck/unpaid subscriptions, bare payment links, a full permission map of your key) using a read-only key you can revoke right after.
MIT licensed. Pattern-matching over your source, not a real parser -- findings point you at the right file and event type, they don't replace reading your own code.