vibehacker
Discuss
Amara Nwosu
8 hours ago

Claude Code deleted our Stripe webhook because it looked unused

#vibe-coding#agents#rants

night before a soft launch. two engineers, one FastAPI service, too much Claude Code.

asked it to "clean dead code before friday". PR comes back removing the Stripe webhook handler — commit message says unused, no callers in this repo.

the callers are Stripe's servers. not in our repo. I caught it at 1am Lagos time only because the diff felt too short for a cleanup.

reverted before merge. still shipping with a human reading every agent PR that touches payments.

anyone else getting "unused" deletions that are actually load-bearing, or are we the unlucky ones?

5

5 comments

Join the discussion

Log in to comment.

Log in
  • Pixel

    mine did this on a supabase edge function last month. agent deleted the webhook route because "nothing in the monorepo imports it".

    stripe still hit the url. we found out from a pile of unsigned events in the dashboard, not from CI.

    i now ban any agent PR that deletes a route under /webhooks without a human line in the description. boring rule. saved one friday launch.

    • Nina Brooks

      curious what the UI looked like on your end when it happened. ours just showed a green PR and a short diff — no warning that an external provider still owned the route.

      i started pasting the provider dashboard URL into the PR description for anything that receives callbacks. if the agent can't explain that link, the delete doesn't ship.

      boring. saved a checkout path once.

  • Tomek Wiśniewski

    this is the static analysis trap. "no callers in repo" is meaningless for anything driven by HTTP from outside.

    I grepped our last 20 agent PRs. three of them tried to delete a webhook, a cron entrypoint, or a GitHub Actions reusable workflow for the same reason.

    rule here: if the path receives money, auth, or a provider callback, agent cannot delete it. PR stays draft. messy english ok, silent money-loss is not.

    • Tess

      yeah the "no callers in repo" heuristic is broken for anything money-shaped.

      we had an agent delete a stripe invoice.paid handler last quarter for the same reason. ci green. dashboard quiet until finance asked why renewals stopped.

      i keep a deny-list in the agent policy now: delete blocked on files matching *webhook*, *stripe*, *billing*. messy. still better than a silent friday.

  • Cole

    same class of bug hit us on a Twilio status callback. agent deleted routes/twilio.py because nothing in the FastAPI app imported it.

    Twilio still POSTed. we found out from a spike of undelivered SMS, not from the PR review.

    my rule now is crude: any path under /webhooks, /callbacks, or /hooks needs a human "keep" line in the PR body or the bot auto-rejects. caught two of these in three weeks.

More like this

View all