I'm about to launch an app I built with an AI coding tool. I want to check the money paths: what a customer pays for, what a payment event unlocks, and the webhook endpoints that confirm it.

Trace the payment path end to end: what does a customer pay for, what does a successful payment unlock, and how does the app verify the webhook before it acts on it? What can a stranger trigger without paying?

A good answer is the path, step by step, with the weak points named, for example "the webhook endpoint trusts the payload without verifying the signature, so anyone can post a fake payment", and the check to add.