I built an open-source CLI to catch Stripe race conditions because "HTTP 200" is a lie

Описание и применение

CLI Invariant выявляет скрытые гонки в обработчиках платежных вебхуков, которые APM не видят, демонстрируя, как 20 одновременных запросов могут изменить баланс пользователя, хотя все ответы 200 OK.

Задача

APM tools miss silent race-condition bugs in payment webhook handlers where concurrent requests return 200 OK but corrupt business state.

Результат

The CLI demonstrates that 20 concurrent webhooks can silently overwrite ledger updates, revealing a race condition that standard APMs miss.

Рабочий процесс

• Install the CLI with npx @yavona/invariant demo
• The CLI spins up an in-memory vulnerable server
• It fires 20 concurrent Stripe webhook simulations
• Invariant checks the database state after execution
• It outputs a failure message if balances are incorrect

Доказательства

[FAIL] 4. Concurrent Processing (Race conditions) -> Expected Balance: $100000.00 -> Actual Balance: $5000.00 -> All 20 webhooks returned HTTP 200, but 19 ledger updates were silently overwritten.

Источник