I built an open-source CLI to catch Stripe race conditions because "HTTP 200" is a lie

Description and use

Invariant CLI uncovers hidden race conditions in payment webhook handlers that APMs miss, showing how 20 concurrent requests can corrupt balances while all responses are 200 OK.

Problem

APM tools miss silent race-condition bugs in payment webhook handlers where concurrent requests return 200 OK but corrupt business state.

Outcome

The CLI demonstrates that 20 concurrent webhooks can silently overwrite ledger updates, revealing a race condition that standard APMs miss.

Workflow

• Install the CLI with npx @yavona/invariant demo
• The CLI spins up an in-memory vulnerable server
• It fires 20 concurrent Stripe webhook simulations
• Invariant checks the database state after execution
• It outputs a failure message if balances are incorrect

Evidence

[FAIL] 4. Concurrent Processing (Race conditions) -> Expected Balance: $100000.00 -> Actual Balance: $5000.00 -> All 20 webhooks returned HTTP 200, but 19 ledger updates were silently overwritten.

Source