I was reading a Stripe tutorial last week and watched the author write amount: req.body.amount. That single line lets any user buy Premium for $1. It's also a common pattern in Stripe Checkout starter code. This post is about why, and how to make it impossible.





The setup


You're building a paywalled product. You wire up Stripe...