Payments and model features
Four guides sit here because a vibe-coded app often adds checkout and a model in the same pass. Two are about money: a webhook that trusts unsigned JSON, and a server that saves a price or role sent by the browser. Two are about models: a route that spends your key with no cap, and text that can steer a model which has tools. Each subject has only two guides, so they share this page instead of a thinner one.
Guides
Unverified Stripe webhooks
A webhook is a public URL. If you trust the JSON without checking Stripe's signature, anyone can tell your app that a payment succeeded.
The client sets the price, role, or plan
If the browser can send amount, plan, or role and the server saves it, users will send the values they want.
No cap on LLM API spend
A model route with your key and no limit is a meter anyone can run. One script can spend a month of budget in an afternoon.
Prompt injection in LLM features
Text you feed a model, including user messages and documents it reads, can contain instructions. If the model can call tools, those instructions can become actions.
Questions
Can I mark an order paid from the success URL?
No. The browser can open that URL without paying. Confirm the Checkout Session on the server, or verify the webhook signature with the raw body and the webhook secret, and ignore unsigned JSON.
The client sends a price id. Is that safe?
Only if the server looks that id up in a list you control and ignores amount, plan, and role fields from the browser. If the handler saves the posted amount, people will post a smaller one.
What is a minimum cap on a model route?
Require a signed-in user, count calls per user per day, and set a monthly spend limit in the provider dashboard. The guide does not invent a dollar figure. The point is that some limit exists in your code and at the provider.
Does a system prompt stop prompt injection?
No. Documents and user messages are data the model will follow if you let them. Tools the model can call have to check the session on the server. The model does not decide who the user is.