A $99 item sold for $1
In this controlled demo, the checkout trusts the price the browser sends. Anyone can change it before paying.
Demo built and tested 20 Sept 2026 · Published 23 Sept 2026 · Last reviewed 23 Sept 2026 · By Ctrl+Z Therapy (how we test)
Can someone pay $1 for a $99 product?
Yes, if your checkout trusts a price sent by the browser. Anything the browser sends can be edited before it reaches your server. In our controlled demo (a fake store with fake data), changing the price to $1.00 produced a $1.00 charge. After the fix, the same request was charged $99.00.
How to tell if your app has this
No code needed.
- Ask your AI tool: "Where does my server get the price and total it charges? Show me the exact line."
- If the answer is the request, a cart sent from the page or a hidden form field, the browser sets your price.
- The safe answer is that the server looks up each product by its ID in your database and calculates the total itself.
Before and after
Price sent by the browser. Nobody checked it.
The server looks up the price itself.
Why AI-built apps end up with this
The page already knows the price because it shows it, so sending it along with the order is the easiest way to build a checkout that works. The problem only appears when someone edits the request, which never happens while you test your own app normally.
How do I fix it? Paste this into your AI tool
My checkout calculates the total from a price sent by the browser. Change it so the server looks up each product's price by its ID, checks the quantity is a whole number from 1 to 99, calculates the total on the server and rejects unknown products. Never trust a price, total or discount that comes from the client.Works with Lovable, Bolt, Cursor, Replit and similar tools. Then run the check-up below on your own app.
How we checked the fix
| Same request | Before | After |
|---|---|---|
| Price changed to $1.00 | Charged $1.00 | Charged $99.00 |
| Unknown product | Not tested | Rejected |
| Quantity of −1 | Not tested | Rejected |
Results from our demo test, run against the same demo before and after the fix.
Common mistakes when fixing this
- Changing the price in the browser is not the problem; people can always do that. Accepting it on the server is.
Questions people ask
Does Stripe prevent this?
Not by itself. Stripe charges the amount your server asks for and doesn't know what your product should cost. If your server passes on a price that came from the browser, Stripe charges that price.
What about discounts and coupons?
Same rule. The server should look up the coupon, check it is valid and calculate the discount. Never accept a discount amount or final total from the page.
How do I check without reading code?
Ask your AI tool where the charged amount comes from and have it show the exact line. Then ask it to add a test that sends a lower price and confirms the full price is charged.
For developers: the cause and the fix in code
− total = body["price"] + total = catalog[sku] * qty
Simplified. Your stack will look different; the principle is the same.