Handle failed payments and duplicate Stripe webhooks
A gym SaaS marked declined cards as paid · Reddit r/vibecoding · u/gigacodes · Feb 2026
The front end took a weekend, then Stripe webhook bugs, auth edge cases and slow queries took weeks. Note: it was posted by an account named after the starter tool the post ends up promoting.
The honest numbers
- Says 3 weeks debugging webhooks
- Says 2 weeks hardening auth
As stated by the source. Not independently verified.
Lesson
Test failed payments and duplicate webhook events on purpose, not just the happy path.
Fix prompt
Copy this into your own AI tool (Cursor, Lovable, Claude Code, Bolt…). It's general guidance written by us. Review what the AI suggests before applying it.
I'm a beginner with a Cursor app that takes payments with Stripe (or a similar provider). Please audit the payment flow. 1) Find the webhook endpoint and check that it verifies the provider's signature using the raw request body, and isn't blocked by my own auth (e.g. Supabase verify_jwt on the function). 2) Check that it handles failed payments, refunds, cancellations and the same event arriving twice (idempotency). 3) Make sure only the server/webhook can change a user's plan or credits, never the browser. 4) List problems with file names and fixes, then give me a test checklist using test-mode events and one small real payment. Don't change anything until I've approved your plan. Never ask me to paste API keys, passwords or .env contents; tell me where to check them myself.
Source: Reddit r/vibecoding ↗