Release
Money is credited on a signature, never on a success URL
A returning browser is a claim made by the customer's own machine, and it can be typed by hand.
FlowFinds never receives a card number. Card details are entered on the payment provider's own hosted page, and what returns to us is a transaction reference and a status. That keeps PCI scope outside our systems by construction rather than by certifying our handling of something we do not hold.
The rule this post is about is narrower and more often got wrong. Money is credited on a confirmation we read back from the provider — through its signed server-to-server notification, and through our own query made against the provider to confirm it — and never because a browser arrived at a success URL. A returning browser is an assertion made by the customer's own machine. It can be typed into an address bar.
Two related invariants hold on the billing path. A paid tier is written by the billing webhook and by nothing else: the meter reads a tier, it never sells one. And an unset billing secret refuses every upgrade call, so the failure mode of a missing configuration is that nobody gets upgraded, rather than that anybody can upgrade themselves.
Every message exchanged with the provider is signed, and every response signature is verified before the response is believed.
Read next
More from FlowFinds
- Newer: What we do not have: no SOC 2, no ISO 27001, no penetration test
- Older: What the agent may never do without a person
- Everything else is in the news index.
To fact-check anything above before you publish it, write to [email protected].