Bug #2
open[SEC-01] Reprice every cart line server-side from the DB/Shopify price before creating the Razorpay order. Reject the request if the client-submitted price doesn't match.
0%
Description
Module: Security / Payment
Current State:
Checkout computes the charge from item["price"] sent by the client (payment_service.py ~line 266) — there is no server-side reload of the authoritative product/variant price before creating the Razorpay order. Verified by reading the code directly.
Task:
Reprice every cart line server-side from the DB/Shopify price before creating the Razorpay order. Reject the request if the client-submitted price doesn't match.
Why It Matters:
No real revenue is at risk yet since there are no real customers using checkout today — but this must be fixed before launch. Retrofitting payment security after real money is flowing is far more expensive (and riskier) than fixing it now, pre-launch.
Target Week: Week 1
Excel Owner: Prabhakar
Excel Priority: P0 - Critical
Excel Status: Not Started
Sprint Plan ID: SEC-01
No data to display