Stripe payments are broken. Usually it's the webhook layer.

“A customer got charged twice for the same purchase.”

Usually a webhook handler that isn't idempotent — Stripe retries an event if it doesn't get a fast 200 response, and a handler that isn't built to safely process the same event twice ends up granting access or charging twice on the retry.

“A customer paid and never got access to the product.”

Common cause: the webhook handler updates the database, but a race condition means the local record didn't exist yet when the event arrived, so the update silently failed.

“Test-mode and live-mode keys got mixed up somewhere.”

One of the most common Stripe integration mistakes — a `pk_test` or `sk_test` key left in a production environment variable, or the reverse, either silently breaking payments or silently charging real cards during testing.

“The webhook endpoint isn't verifying Stripe's signature.”

Without verifying the `Stripe-Signature` header, the endpoint will process a request from anyone who knows the URL, not just from Stripe — a real, documented security gap, not a hypothetical one.

“A subscription cancels or downgrades and the app doesn't notice for days.”

Usually means the app isn't listening for the specific event type that fires on that change, or is listening but silently swallowing an error while processing it.

“Refunds issued in Stripe's dashboard don't do anything in the app.”

A refund is a Stripe-side action that only affects your app if something is listening for the corresponding webhook event and acting on it — most vibe-coded integrations only ever handle the initial payment event.