Ship It Checklist

Checklists /Bolt /Payments

Critical

Do not trust a price sent from the browser

A generated checkout often sends the price from the page. Anyone can edit that request and pay less, or nothing. The server should look up a Stripe price id that you created.

How to check

  1. Search for unit_amount, price, and checkout.sessions.
  2. If unit_amount comes from the request body or from a frontend constant that the browser can change, treat it as unpaid work.
  3. The Stripe secret key must be server-only.
  4. In Stripe test mode, pay once and confirm the amount on the Stripe payment matches the price you expect.

Prompt

Fix prompt
Paste into Cursor or Claude Code
You are working in this repository. Do not add features.

Goal: Checkout Sessions are created on the server with a Stripe price id, not with an amount chosen in the browser.

Steps:
1. Find where the Checkout Session is created.
2. Move that call to server code if it runs in the browser.
3. Use a price id from the environment or from your own database. Ignore any amount field on the incoming request.
4. Keep the Stripe secret on the server only.
5. Do not print keys. Tell me the env var names to set in test mode.

This uses the same ticks as the checklist page, saved in this browser.

Related error fixes