Dev tool
Find out your checkout leaks paid content before a customer does.
Every check here comes from a real production incident, not a guess. Paste your route files for a free instant check, or pay $19 to scan a full public GitHub repo automatically.
Free, full check, no account. Nothing you paste is stored — it's scanned in your browser.
Scan results
Paste your files to see results instantly.
Or scan a full public GitHub repo automatically — $19
Skip the copy-paste. Give us a public repo URL and we'll fetch and scan it for you.
Frequently asked
What does this actually catch?
Nine rules pulled from real bugs found in a live production Stripe codebase: the checkout amount or Price id coming from the request instead of a server-side table, a paid route checking payment_status but not which product was bought, a paid result rebuilt from a URL query parameter or a request body field after the session was already verified, entitlement staged in sessionStorage/localStorage and replayed, a webhook route with no signature verification, a secret key reachable from the client bundle, and a success_url treated as proof of payment. Measured on a production codebase across its own git history: 13 criticals found the day before its venture-047 fix, 0 findings on the fixed tree across 361 source files.
Is this a real build or a live-account check?
Neither. It's static analysis over source and file paths — it doesn't run a build and it doesn't call your Stripe account, so a clean result means 'no known payment-safety pattern found,' not a guarantee. Things it can't see from source (whether your webhook secret matches the one registered in Stripe, whether refunds and proration behave correctly, whether a restricted key's scopes are narrower than the code needs) are listed on every report.
How does the free check work?
Paste your route files using the '### FILE: path' marker format shown in the placeholder text. Everything runs in your browser — nothing you paste is sent anywhere or stored.
What does the $19 tier add?
Automation, not more checks: give us a public GitHub repo URL and we fetch the relevant .ts/.tsx/.js/.jsx source files and run the same scan for you, no copy-pasting required.
How is this different from the $49 live-account audit?
This is a free-to-$19, static, source-only layer that pattern-matches your code before you deploy. The live-account audit checks your actual Stripe account (webhook delivery history, stuck subscriptions, bare payment links, a full permission map of your key) using a read-only key you can revoke right after.