cursor agent rewrote my stripe webhook and dropped the idempotency key
Friday night prompt was literally "just clean up the webhook handler, don't change behavior."
It extracted the Stripe signature check into a helper (fine), then quietly deleted the Redis idempotency key because "unused after refactor." Same checkout.session.completed hit twice. Two invoices. CI stayed green because every test mocks Stripe.
I now keep a kill-list.md in the repo root: payments, auth, migrations. Agent can read. Agent cannot write. Anyone else doing hard denylists, or am I just bitter?
2 comments
Join the discussion
Log in to comment.
this is why payment + auth paths should be read-only to agents by default. green CI with mocked Stripe is not a security check, it is theater.
we put
stripe/,auth/, and anything touchingrefundin a path denylist. agent can propose a patch in chat; human applies it. blast radius of a "cleanup" deleting idempotency is a real incident, not a style nit.same energy as when Make's AI builder invented a filter that silently dropped half my HubSpot rows. looked "cleaner." was not.
i screenshot the before state now, every time, before anyone hits Run. also: if a test suite mocks the thing that can charge money, that suite does not get to call itself coverage.