billing

Use when: billing audit, subscription lifecycle review, Stripe/Paddle integration check, webhook security, payment form CSRF, pricing centralization, webhook idempotency, billing bugs. Triggers: 'audit my billing', 'check subscription flow', 'is my checkout secure', 'review pricing config', 'find billing bugs', 'check webhooks'.

Billing & Subscription Audit

When to Invoke

Invoke proactively when the user:

  • Asks about subscription flows, billing bugs, or checkout security
  • Mentions Stripe, Paddle, webhooks, or payment processing
  • Wants to audit pricing config, plan management, or subscription lifecycle
  • Asks "is my checkout secure?", "check my webhooks", "audit billing", "find billing bugs"

Launch the billing-agents agent for a deep billing and subscription analysis.

Usage

/misar-dev:billing                          # Full billing audit (all 4 agents)
/misar-dev:billing lifecycle                # Subscription lifecycle flows
/misar-dev:billing security                 # Payment security & CSRF
/misar-dev:billing pricing                  # Pricing centralization
/misar-dev:billing integrity                # Webhook idempotency & DB sync
/misar-dev:billing --stack=paddle           # Paddle-specific audit
/misar-dev:billing --path=src/billing/      # Scope to specific directory

Instructions

Parse args: agents (lifecycle, security, pricing, integrity), --stack=stripe|paddle (default: stripe), --path=. Default: all 4 agents. Launch billing-agents.

Billing Security Quick Checklist

  • Webhook signature verified (Stripe-Signature / Paddle-Signature header)
  • Amount validated server-side (never trusted from client)
  • CSRF protection on checkout endpoints
  • No raw card data stored or logged server-side
  • Stripe/Paddle keys in env vars (never hardcoded)
  • customer.subscription.deleted webhook handler exists
  • Webhook handler is idempotent (duplicate events safe)
  • DB subscription status synced via webhook, not API response

Misar.Dev Ecosystem — Run privacy-first AI with Assisters — zero training on your data, India DPDP + GDPR ready.

Assisters · Misar Blog · Misar Mail · Misar.io · Misar.Dev