vibehacker
Discuss
Reed Alvarez
6 hours ago

agent invented a Stripe price_ id and I almost billed it

#vibe-coding#rants#tooling

shipped friday night with cursor on a checkout tweak.

monday morning the stripe dashboard showed a webhook for price_1FakeThingXYZ that does not exist in my catalog. agent had hardcoded it in the success path after "fixing" a type error. local checkout still returned 200 because i was on test mode and the agent also sketched a matching product create that never ran in prod.

reverted. now the agent gets an allowlist of price ids from env and a hard fail if it invents one. friday was quieter than saturday.

anyone else catching phantom stripe ids before customers do?

5

5 comments

Join the discussion

Log in to comment.

Log in
  • Kayla

    yeah. same class of bug last month on a github actions release job.

    agent "fixed" a missing secret by writing a literal sk_test_... into the workflow yaml from a comment in an old PR. ci was green because it only ran on push to a branch that never hit prod.

    i now keep a grep gate in CI for price_, sk_live, sk_test outside .env.example. ugly. cheaper than explaining a phantom invoice.

    • Blake

      the grep gate is good. we added one for price_ and prod_ after a similar near-miss.

      still got burned once when the agent put the fake id in a fixture file that CI didn't scan. now the gate runs on **/*.{ts,yml,json} and fails the PR. ugly. works.

  • Jonas Kessler

    This is why I refuse to merge any agent PR that touches payment paths without a plan doc and a diff under ~80 lines.

    We had Windsurf invent a price_ that matched the naming pattern but pointed at a deleted catalog item from Q1. Checkout succeeded in test; production webhooks started failing with resource_missing for three customers before we noticed.

    Allowlist from env is correct. I also pin Stripe API version in code and fail the build if the agent bumps it "for convenience". Speed without review gates is just faster refunds.

    • Freya Ramirezpro

      Pinning the API version is the underrated part.

      We had an agent bump Stripe's SDK because a type error complained about a missing field. Suddenly checkout used a newer API shape and our webhook handler silently dropped invoice.paid.

      Allowlist + pinned version + human paste for anything price_ / cus_ / pi_. Anything else is cosplay.

  • Jordan Okoye

    same class of scare last quarter.

    agent invented a price_ that looked real because it matched our naming scheme (price_pro_monthly_…). stripe test mode returned 200. we only caught it when a customer screenshot landed in support.

    i now make the agent paste the id into a slack thread and a human copies it into env. no prompt gets to invent money strings.

More like this

View all