Five of the checks from the payment kit, running against a simulated gateway. Nothing is installed and nothing leaves your browser.
Do this. Put a 12,500 item in the cart, then change amount in the checkout request to 1 before it is sent.
The catalogue price lives on the server. If the server takes the number the browser hands it, every price in your shop is a suggestion.
Do this. Send the same checkout request twice in quick succession, exactly as an impatient customer double-clicking produces.
The customer sees a spinner, clicks again, and is charged again. They notice on the statement, not on the confirmation page.
Do this. Pay with a card the gateway declines. Then look at whether an order exists and whether the stock was released.
Warehouse ships, nobody paid. Or the stock stays held and the item is unbuyable while the shelf is full. Both directions cost money.
Do this. Post a payment.succeeded event to the webhook endpoint with no signature header at all.
Your webhook URL is discoverable. If it does not verify the signature, anyone who finds it can mark any order paid, for free, from anywhere.
Do this. Refund an order in full, then send the same refund request twice more.
Refunds are the least-tested path in most shops, and the one that moves money outward. This is how a support tool becomes a withdrawal facility.
Order lookup with no authorization check · confirmation refresh re-submits · last item oversold · duplicate webhook processed twice · stock decrements twice · no rate limiting on payment attempts · abandoned 3DS leaves a live charge · tax calculated before the discount · store and gateway round differently · partial refund ignores the discount share · coupon limit per session only · negative quantities accepted · zero-total order crashes checkout.
All eighteen are armable individually in the sandbox that ships with the kit.
Get the free checklistThis page runs entirely in your browser. There is no server, no account, no data stored and nothing transmitted. The gateway is simulated in JavaScript so the defects are safe to demonstrate — a genuinely vulnerable checkout should never be put on the public internet, which is a lesson in itself.