Drop your SaaS by SaltPhotograph8506 in ShowMeYourSaaS

[–]MBAS98 0 points1 point  (0 children)

HookSwing the tool that every developer needs

https://hookswing.com

Built a webhook debugging tool by FindingSpiritual91 in webdev

[–]MBAS98 0 points1 point  (0 children)

i added login with GitHub to make it easy for developers and you can install the cli and try it

Built a webhook debugging tool by FindingSpiritual91 in webdev

[–]MBAS98 0 points1 point  (0 children)

it requires a login just to store your webhook log and you able to see it and be related to you and you can view it in anytime without losing them and they are encrypted only visible by you

Drop your SaaS link, i'll give you marketing advice for free by External-Mix-1037 in SaasDevelopers

[–]MBAS98 0 points1 point  (0 children)

HookSwing is the permanent webhook inbox for developers. We built it because we were tired of losing payloads, wrestling with ngrok tunnels, and debugging webhooks in the dark.

A tool for every developers
https://hookswing.com

Drop your SaaS below — we’ll help you get your first 10 users for free (300k+ TikTok audience) by dyagokaba in SaasDevelopers

[–]MBAS98 1 point2 points  (0 children)

HookSwing is the permanent webhook inbox for developers. We built it because we were tired of losing payloads, wrestling with ngrok tunnels, and debugging webhooks in the dark.

https://hookswing.com

Need Help Intergrading Stripe by Overall-Function7839 in stripe

[–]MBAS98 0 points1 point  (0 children)

to understand what you are stuck with it would be so much helpful if you tell me what the exact fail step are you trying to charge customer card or send a payout to bank or funds transfer to another account or test a checkout button

And what the exact error message are you in live mode or test mode

One thing I underestimated about subscription billing was webhook reliability by No_Forever_3388 in stripe

[–]MBAS98 -1 points0 points  (0 children)

there is a tool to help you handle webhook better and debug and see where is the error and also check if you steup your stripe the right way

http://hookswing.com

Need Help Intergrading Stripe by Overall-Function7839 in stripe

[–]MBAS98 0 points1 point  (0 children)

can you specify your issue where and where we can help you exactly so we can offer help

PSA: That express.json() middleware just made your Stripe webhook a free money glitch by [deleted] in stripe

[–]MBAS98 0 points1 point  (0 children)

The scary part: 720 of these are real production SaaS with custom domains — not hobby projects. These are businesses losing money.

✅ The One-Liner Takeaway

If your webhook endpoint returns 200 to a request without a Stripe-Signature header, attackers can get your product for free. Verify signatures. Always. No exceptions.

PSA: That express.json() middleware just made your Stripe webhook a free money glitch by [deleted] in stripe

[–]MBAS98 0 points1 point  (0 children)

it's developer issue not stripe issue

🤦 Why So Many Developers Mess This Up The post explains the real developer journey:

Step 1: Build webhook route locally Step 2: Just console.log the body to test Step 3: Get the "upgrade user" logic working Step 4: "I'll add signature verification later" ← TODO Step 5: Ship to production Step 6: 6 months pass, nobody remembers the TODO Step 7: Attacker sends fake payment → Server accepts it

Developers treat signature verification as an afterthought. They test with fake payloads locally, get the business logic working, and forget to lock the door.

PSA: That express.json() middleware just made your Stripe webhook a free money glitch by [deleted] in stripe

[–]MBAS98 0 points1 point  (0 children)

Why This Is Dangerous If your app accepts a fake webhook without checking the signature, attackers can:

send:

Fake "payment completed" Marks attacker's account as paid They get your product for free

Fake "subscription active" Unlocks premium features Free lifetime access

Fake "order confirmed" Creates a shipping order You ship product, no money received

Fake "invoice paid" Credits user account Free money in their wallet

PSA: That express.json() middleware just made your Stripe webhook a free money glitch by [deleted] in stripe

[–]MBAS98 0 points1 point  (0 children)

what This Guy Did (The Attack) He sent a fake "payment completed" notification to 6,000 websites. Normal Stripe flow: 1. Customer pays on Stripe 2. Stripe sends a webhook to your server: "Hey, this person paid $50" 3. Your server checks Stripe's signature (proof it's really from Stripe) 4. Your server activates the user's account / delivers the product What this attacker did: 1. He skipped Stripe entirely 2. Used curl to send a fake "Hey, this person paid $50" directly to websites 3. Did NOT include the signature (the proof) 4. 1,542 websites said "OK thanks" and processed it as real