This report is a file on your computer. Nothing was sent anywhere.

Canceled customers keep paid access.

This leaks money every day until it is fixed.

watch-this, a Next.js app, with Supabase, Stripe test mode

What we tested

Akeso acted out ten billing situations against your app: paying, canceling, a failing card, a refund. After each one it asked your app the same question: does this customer still have paid access?

✓New payment unlocks access

?Trial ends, subscription becomes activenot provable: access was already on when this scenario started

?Monthly renewal payment keeps accessnot provable: access was already on when this scenario started

✗Card fails, retries exhaust: access endsaccess should have ended, but your app still grants it

✗Customer cancels; period ends: access endsaccess should have ended, but your app still grants it

✗Immediate cancellation removes accessaccess should have ended, but your app still grants it

?Customer un-cancels before the period endsnot provable: access was already on when this scenario started

•Latest charge refunded (follows the app's own policy)your app's policy: keeps access

✗The same event delivered twiceaccess should have ended, but your app still grants it

✗An old 'still active' event arrives after cancellationaccess should have ended, but your app still grants it

What your code shows

Read from your webhook handler and access checks, before anything ran.

!The handler ignores 6 of the 7 lifecycle events: invoice.paid, invoice.payment_failed, customer.subscription.created, customer.subscription.updated, customer.subscription.deleted, charge.refunded.

What this did not check

Only the billing lifecycle was tested. Not login, checkout UI, or anything else.
Events were delivered locally with your app's own webhook secret. If your handler re-fetches objects from Stripe's API, run the sandbox mode with your Stripe test key for full fidelity.