Stripe webhook idempotency audit

The brief

Audit our Stripe webhook handler for replay/double-capture bugs. Add event-id idempotency, signature verification, a reconciliation cron, and a status-guarded capture path. Write up the threats you closed.

Stack

Take action