Payment holes in AI-built apps

160 of the apps take payments, mostly through Stripe and Square. They are the riskiest group in the study: 50% had a high or critical problem.

50%

of apps taking payments had a high or critical problem

9%

had a hole in the payment flow itself

12%

had a serious problem we could prove from the code alone

Most common problems in apps that take payments

Share of apps that take payments.

Most common problems in apps that take payments
ProblemShare of apps
Packages with a known security flaw45%
Raw HTML from users put on the page11%
Supabase Edge Function anyone can call10%
Secret in a variable shipped to the browser9%
User input built into SQL (Python)7%
Table with row level security off7%
Database function anyone can run6%

The usual mistakes

  • The webhook that marks an order paid does not check the payment provider's signature, so anyone can send a fake "paid" message.
  • Paid status, credits or the plan are written from the browser, so a user can give themselves the paid plan.
  • Secret payment keys sit in a public variable or in the code.

Data: Redproof's automated checks on public GitHub repositories, November 2026. No repository is named. Method and limits