security-review-owasp-third-party-payment-gateway-integration

Prevent order tampering by recalculating prices, discounts, taxes, and currencies on the server from trusted data. Untrusted client input should never dictate the final amount. This Skill analyzes your payment initialization flow to verify server-side amount validation is enforced.

Verify webhook signatures by validating callback authentication and redirect-return handling. This Skill evaluates your callback logic to ensure spoofed payment completion attempts are blocked and server-to-server confirmation occurs before fulfillment.

Implement idempotency to stop replay attacks by enforcing duplicate transaction handling and replay resistance. This Skill assesses your codebase for idempotent fulfillment controls and fraud telemetry logging to identify suspicious payment activity.

Payment-state forgery tricks systems into fulfilling orders without verified payment. Secure fulfillment sequencing requires server-to-server verification before releasing goods. This Skill analyzes your operational controls to ensure fulfillment only triggers after confirmed payment state.

This security review works with server-to-server verification, redirect returns, and webhooks. It analyzes your payment gateway integration code and configuration to identify untrusted input vulnerabilities and callback trust issues across all return types.