Stripe webhook security review: the $2,400 checkout check

A Stripe webhook security review answers one owner question: can a stranger mark an order paid, or read someone else’s Checkout Session, on the app you already run.

I sell that as one authorized web application security review. $2,400 once per app. $1,200 to start. The report is written 48 hours after access works. You own the PDF. No subscription.

Short answer: A Stripe webhook security review checks that your endpoint verifies Stripe’s signature on the raw body, and that a Checkout Session is not readable by the wrong person. I do both inside the web application security review: $2,400 once, $1,200 to start, 48 hours after access. It is not a monthly scanner.

What does a Stripe webhook security review check?#

A Stripe webhook security review checks signature verification on the raw body and who can read a Checkout Session. Both sit inside one authorized app review: $2,400 once, $1,200 to start, written 48 hours after access works.

Stripe’s webhook docs say the handler verifies the payload with the Stripe-Signature header and that endpoint’s whsec_ secret, on the raw body. If a framework parses the body first, verification fails, or you skip it and trust whatever JSON arrived. Return a 2xx before slow work such as updating an invoice.

Official libraries default to a 5-minute tolerance. A tolerance of 0 turns the recency check off. Live mode retries for up to three days. Sandbox retries three times over a few hours. Fulfill on every delivery and a retry ships the order twice.

Each endpoint has its own secret. Test and live differ even on the same URL. The stripe listen secret is not the Dashboard secret. Mixing them is why a check works on a laptop and fails in production.

The rest of the pass is the calls the page already makes. The broader version is API security review. Checkout is the payment slice.

What does a Stripe webhook security review cost?#

The review is $2,400 once for one application. $1,200 starts it and the balance is due when the report is delivered. You own the PDF. There is no monthly fee. A second app, a source audit, or a certification letter is a different quote.

Over 24 months and over 36 months the number stays $2,400. There is no seat fee to compound. The same figure is on security review pricing.

What you are buying	Price	What you actually get
This review, one web app	$2,400 once, $1,200 to start	Frontend, auth, API, webhook signature, Checkout Session reads. Written 48 hours after access.
A second app	Another $2,400	Same scope, a new written authorization
Source-code audit or a certification letter	Not this quote	Separate work. I do not invent certifications.
Workflow Automation	$3,500 once	One named ops job, such as copying refunds into QuickBooks. Not a security review.
AI Front Door	$3,500, $7,500, or $14,000 once	Customers book or pay from an AI app. Not a webhook review.

How should the webhook fulfill an order?#

Stripe says fulfillment belongs on the webhook, not the success page, because the customer may never land there. Verify the signature, store the event id once, mark the order paid in your system of record, and return a 2xx before the slow work.

Stripe’s fulfillment guide says you cannot rely on the success page. A buyer can pay and drop off before it loads. Hosted Checkout waits up to 10 seconds for checkout.session.completed before redirecting. On the CLI, the redirect is immediate. Production is the 10-second path.

Step	Action	System of record	Human escalation
Trigger	Stripe posts checkout.session.completed	Stripe event	None
Verify	Signature on the raw body, this endpoint’s secret, timestamp inside five minutes	Your webhook handler	Fail closed and page a person if verification fails
Record	Store the event id once	Your orders table	A duplicate delivery must not fulfill again
Fulfill	Mark paid only after the verified event	Orders, Jobber, or the sheet you already trust	Amount, currency, or customer does not match the order you created
Show receipt	Success page may load that buyer’s session	Your app, using the secret key server-side	Staff lookup is a separate signed-in path

Copying refunds into QuickBooks is a different product: Workflow Automation, $3,500 once for one named job, live in 7 to 10 days. It does not replace the signature check.

Who can read a Checkout Session?#

Retrieving a Checkout Session is an API call made with your secret key. The success URL can carry the session id. The review asks whether a route that accepts that id returns another person’s email, address, or payment status.

Stripe’s retrieve Checkout Session call uses the secret key. The success page docs tell you to put {CHECKOUT_SESSION_ID} on success_url. That id then sits in an address bar, a support chat, or a referrer log.

The question is your route. Who may ask your server to load that session, and which fields come back? The buyer seeing their own receipt is the point. A stranger seeing email, address, or payment status is the finding. I write the path, the severity, and the fix. No recipe in the PDF.

Customers paying from ChatGPT, Claude, or Grok is a different build: AI Front Door, from $3,500. The same connection works in whichever of those apps they already use. It is not this review.

What is on the first-pass checklist?#

I walk the payment path your UI already uses: raw body before any parser, the dashboard secret for that endpoint, live and test secrets kept apart, a five-minute timestamp window, and one fulfillment row per event id.

Hand this to whoever owns the handler:

• The framework does not parse the body before the signature check.
• The secret is the Dashboard whsec_ for this endpoint, not the CLI secret, and live is not swapped with test.
• Fulfillment is keyed by Stripe’s event id, because live retries run for up to three days.
• A route that accepts a session id does not return another customer’s email, address, or payment status.
• You can roll the signing secret. Stripe allows up to 24 hours of overlap while you update the server.

When this isn’t the right move yet#

Wait if Checkout is not live, if you need a PCI letter I do not sell, or if the real job is chasing refunds in QuickBooks. That last job is Workflow Automation, not a security review.

Skip the review when:

• You have no Checkout Session and no webhook endpoint yet. There is nothing to authorize.
• You need a PCI QSA, a CREST letter, or a procurement stamp. I do not sell those.
• The app is a mobile binary, an internal network, or a source-only audit. Those are other quotes.
• You will not sign written authorization. I do not start on a system the sender does not own.
• The pain is unpaid invoices or a Friday refund export. Buy the ops job, not a security PDF.

A redacted sample, with no client names and no exploit payloads, is on the sample request form. Scope and the payment split sit on Web application security review.

Send the app URL and say whether Checkout is test mode or live. Start the review at $1,200. I reply with the scope map within 24 hours. If you would rather talk through the workflow and whether the review fits, book a 20-minute call.