[waleedlatif1]

Summary

• The Better Auth Stripe plugin was configured with stripeWebhookSecret: env.STRIPE_WEBHOOK_SECRET || ''. Stripe's verifier accepts a signature computed with an empty key, so with billing on and the secret unset, the plugin's own falsy-secret check was the only thing keeping /api/auth/stripe/webhook from accepting forged events
• Not exploitable on the pinned @better-auth/stripe@1.6.27 (it 500s with STRIPE_WEBHOOK_SECRET_NOT_FOUND before verifying), but we shouldn't depend on that
• resolveStripeBilling() now returns the client + secret only when billing is on and both STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET are set; otherwise it logs an error and the plugin (and stripeCustomerId user field) stay unregistered, the same state as billing on with no Stripe key
• Didn't throw at auth init (would take down sign-in for the deployment) and didn't add an env refinement (env.ts runs with skipValidation: true)
• sim-setup preflight now requires STRIPE_WEBHOOK_SECRET alongside STRIPE_SECRET_KEY when BILLING_ENABLED is on

Type of Change

• Bug fix

Testing

• Loaded the real @/lib/auth/auth module under each billing env config on origin/staging and on this branch, posting forged (empty-key HMAC) and correctly signed events to /api/auth/stripe/webhook and an unauthenticated /api/auth/subscription/upgrade:

Config	staging	this branch
billing on, key, secret unset	webhook 500 / upgrade 400	webhook 404 / upgrade 404 + startup error log
billing on, key, secret set	forged 400, signed 200, upgrade 400	identical
billing on, no key	404 / 404 / 404	identical
billing off	404 / 404 / 404	identical

• Confirmed directly that stripe.webhooks.constructEvent(payload, sig, '') accepts a signature forged with an empty key (Node crypto provider)
• packages/sim-setup/src/checks.test.ts, biome, comment hygiene; type-check and audits left to CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 24, 2026 6:35pm UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Stripe billing now registers only when billing is enabled and both Stripe secrets are present.

• Stripe billing starts only when its webhook secret is configured.
• Setup preflight requires both Stripe secrets when billing is on.

_{Reviews (2) · Last reviewed commit: "fix(billing): treat a whitespace-only St..." · Reviewed by Greptile}

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Heads up: you’ve reached your flex budget. Increase your flex budget or wait for usage to reset.

Turn on auto-fix | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Heads up: you’ve reached your flex budget. Increase your flex budget or wait for usage to reset.

Turn on auto-fix | Re-trigger cubic</sub>