StripeCheckup

Try 3 checks free right now, no account, no card. The full 7-check report is $49, one time.

No live key? Paste your code instead

Paste your webhook handler and/or checkout-session-creation code (any language). No Stripe key, no account, works before you've even gone live. Checks for the exact mistakes in t3dotgg/stripe-recommendations (6.4k stars) — a widely-read checklist with no automated way to check it, until now.

What the full $49 report checks

Fired-but-unhandled events — cross-references your actual event history against what your webhook is subscribed to. If Stripe fired an event your code never heard about, this is the only tool that tells you.
Webhook event coverage — flags missing subscription-lifecycle events, especially customer.subscription.updated, the one that catches a subscription going unpaid without being canceled outright.
Webhook endpoint URLs — flags an enabled webhook still pointing at localhost, an ngrok tunnel, or plain HTTP — a dev URL left live after launch means every event since has gone nowhere.
Stuck subscriptions — counts subscriptions sitting in unpaid/past_due/incomplete, a sign of a dunning gap.
Payment link configuration — flags links with no metadata or custom fields, where a sale can't be told apart from any other or you can't tell what the buyer actually wanted.
Checkout session fulfillment — flags paid sessions with no attached customer record, a common cause of "they paid and got nothing."
Key permission map — shows exactly what the key you gave us can and can't read, so you can tighten it afterward.

Built after hitting the same bug three times in one month shipping five different Stripe integrations: a webhook that silently stopped booking revenue, a handler that never checked customer.subscription.updated, and payment links that gave no way to know what a buyer actually wanted. Nothing here is theoretical -- every check exists because it once cost real money. Read the story.

Already run a security scanner on your Lovable/Bolt/Replit app? Those check your database rules, your auth, your exposed keys -- real problems, worth fixing. None of them open a Stripe connection and check whether your webhook is actually subscribed to the events Stripe is sending, or whether a paid Checkout Session ever got a customer record attached. That's a different layer: your database can be locked down tight and your billing logic can still silently eat a payment. Read the checklist.

Your key is never stored. It's used in memory for the single request that generates your report, then discarded -- not logged, not written to disk, not kept after the response is sent. Create a new restricted key scoped to Read on Events, Webhook Endpoints, Subscriptions, Payment Links, Checkout Sessions and Customers (Stripe Dashboard → Developers → API keys → Create restricted key), run the audit, then revoke it if you like -- the report doesn't need standing access.

Privacy · Terms

Other tools from the same builder: CloakCheck (AI-agent prompt-injection scanner) · KDPCheck (KDP AI-disclosure checker) · Edge Thirteen (value-investing newsletter) · TriageShield (AI-slop vuln-report checker) · FilingCheck (SEC-grounded stock reports) · BrewClear (TTB label clearance) · MarkRadar (trademark + domain-squat alerts) · ExploitWatch (EU CRA exploit alerts) · AuditFlag (SEC going-concern alerts) · RenewalMatrix (click-to-cancel compliance) · SlopCheck (YouTube demonetization-risk checker) · VercelPyCheck (Vercel Python deploy bug scanner)

Free instant check

No live key? Paste your code instead

What the full $49 report checks