Payments

Projects

Problem records

• Documentation links that were only broken from CI

  The first scheduled link check reported 14 broken Razorpay links. They load from Europe but answer 404 to GitHub-hosted runners.

  MitigatedPandaPayLens26 Oct 2026

• A shared id prefix made Checkout.com a false alternative

  A record whose only Checkout.com trait was a pay_ id scored higher than a loosely matching record with documented fields, so every Razorpay payment listed Checkout.com as an alternative.

  ResolvedPandaPayLens25 Oct 2026

• A refund delivered twice looked like two refunds

  Providers that send notifications without a delivery id defeated duplicate detection, so a repeated refund notification could be read as refunds exceeding the payment.

  ResolvedPandaPayLens25 Oct 2026

• The timeline showed late payment steps first

  Events without a timestamp were sorted after every timed event, so a Paystack flow appeared with the webhook and verification before the PIN and OTP steps.

  ResolvedPandaPayLens25 Oct 2026

• Redaction regexes that ran in quadratic time on long text

  Two patterns used to hide email-like values in provider text backtracked from every position on long input without whitespace. Both were replaced with bounded, linear-time alternatives.

  ResolvedPandaPayLens25 Oct 2026

Journal

• Twelve payment and webhook code reviews: the bugs that keep coming back

  In October 2026 I reviewed twelve pull requests in Stripe, PayPal, Razorpay, Adyen, Payload, Medusa, Better Auth, Svix, Standard Webhooks, n8n and Hyperswitch code. Most findings fall into five patterns.

  Code review26 Oct 2026

• Stripe webhook ordering in Better Auth: how a retry can drop onTrialEnd

  Refetching the subscription is the right fix for Stripe snapshot events. Deriving lifecycle callbacks from the event while guarding them with the stored row meant a retried event could skip onTrialEnd, onTrialExpired and onSubscriptionCancel.

  Code review26 Oct 2026

• Payload's Stripe adapter and the 500-character metadata limit: keep the check, store a digest

  Payload ecommerce put the whole cart into Stripe PaymentIntent metadata, so checkout failed at about eight items. Removing it fixed checkout and removed the only item-drift check; a 64-character hash keeps both.

  Code review26 Oct 2026

• Constant-time webhook signatures in razorpay-node: when the fix accepts more than the bug did

  A pull request replaced === with crypto.timingSafeEqual in razorpay-node. Decoding the signature as hex made the check accept upper-case, truncated and padded signatures, and the new tests never ran.

  Code review26 Oct 2026

• Typing PayPal Card Fields onApprove per flow instead of making orderID optional

  A paypal-js pull request made orderID optional to support vault flows, a breaking type change for every order integration. Typing onApprove per branch of an existing union fixed it, and the author adopted the suggestion.

  Code review26 Oct 2026

• stripe-node endpointFetch headers: passing them through is not the same as using them

  A stripe-node change stops the endpointFetch HTTP client from discarding response headers. Two follow-ups: retry-after does not affect backoff, and a plain object makes header lookups case-sensitive.

  Code review26 Oct 2026

• stripe-react-native shipping details: unblocking a failing API surface check

  A fix for missing carrier, phone and tracking number in stripe-react-native shipping details was stuck on a failing CI check. The remaining diff was not in the pull request at all, and the type still accepted a field that the native SDKs drop.

  Code review26 Oct 2026

• postMessage origin and source checks in the Hyperswitch web SDK, and why the fix should ship alone

  Hyperswitch Web validated neither origin nor source before confirming a payment from a message. The sender checks are solid; the pull request also bundles behavior changes and describes features that are not in the code.

  Code review26 Oct 2026

• A refund race in Medusa: why counting pending refunds overstates refunded_amount

  Medusa recomputes the refunded amount after a provider rejects a refund, which fixes the race the test forces. The total still counts unconfirmed refunds, and the recompute in the catch block can hide the provider error.

  Code review26 Oct 2026

• Orphaned 3DS2 postMessage listeners in Adyen Web, and a detached-node check that misses shadow DOM

  A Drop-in torn down without unmount leaves a window message listener behind, so a later 3DS2 challenge completes twice. The guard uses document.contains, which is always false inside a shadow root.

  Code review26 Oct 2026