I built an open-source CLI to catch Stripe race conditions because "HTTP 200" is a lie

说明与用途

Invariant CLI 发现支付 webhook 处理中的隐藏竞争条件，展示 20 个并发请求如何在所有返回 200 OK 的情况下破坏余额。

问题

APM tools miss silent race-condition bugs in payment webhook handlers where concurrent requests return 200 OK but corrupt business state.

结果

The CLI demonstrates that 20 concurrent webhooks can silently overwrite ledger updates, revealing a race condition that standard APMs miss.

工作流

• Install the CLI with npx @yavona/invariant demo
• The CLI spins up an in-memory vulnerable server
• It fires 20 concurrent Stripe webhook simulations
• Invariant checks the database state after execution
• It outputs a failure message if balances are incorrect

证据

[FAIL] 4. Concurrent Processing (Race conditions) -> Expected Balance: $100000.00 -> Actual Balance: $5000.00 -> All 20 webhooks returned HTTP 200, but 19 ledger updates were silently overwritten.

来源