Closed a critical checkout hole in a client's store

The complaint

It arrived as a small billing annoyance. Buy more than two of one item and the total came out wrong. That reads like a rounding error, and a rounding error is a ten-minute fix — which is exactly why it is worth opening the hood before you agree with it.

What it actually was

The checkout was trusting the price the customer's own browser sent it. Nothing on the store's side was checking that number against anything the store knew.

We proved it against the live checkout. A $57 order was accepted at $2,007 with a tampered price. The same move in reverse hands over real product for almost nothing — fifty dollars of goods for two.

That is not a billing bug. That is a store with no opinion about its own prices.

The fix

A server-side price guard. The store now keeps its own catalog, recomputes every line from it, and discards whatever the browser submitted. Unknown product ids are rejected rather than trusted. Quantities are clamped. The customer's computer no longer gets a vote.

It is a machine rather than a patch, because the same guard drops into any storefront that takes an order from a browser — which is all of them.

The part worth keeping

The fix was written, tested and ready. Then it went to an independent review whose entire job is to assume the person who wrote it missed something. It had.

The checkout carried an "add one more" control that referred to a product by a slightly different name than the new catalog recognised. The guard, doing exactly what it was told, would have rejected the customer's whole order. Not an attacker — an ordinary buyer, mid-purchase, pressing a normal button.

So look at the shape of that. We set out to close a hole that let the store lose money, and the patch itself was one click away from a store that quietly refuses to sell. A more expensive failure than the one we started with, hiding inside the solution.

The mismatch was a one-line correction. We made it, re-ran the checks — eight cases this time, including the exact control that would have failed — and only then did it go anywhere near production.

Where it stands

The fix is live, verified, and reversible. Remaining hardening is tracked privately until it is closed.