Notes from the gate
What we learn running an abuse firewall for software businesses: the attacks, the numbers, and the mistakes we made so you don't have to.
- 7 Sept 2026how-to13 min read
x402 middleware fraud: screening the payer wallet in Hono
x402 middleware fraud screening in Hono: decode the payer wallet from PAYMENT-SIGNATURE, score velocity, and block bad payments before they settle on Base.
- 7 Sept 2026how-to10 min read
WorkOS AuthKit in Next.js 15: middleware, callback, and the cookie error
WorkOS AuthKit Next.js 15 setup: env vars, authkitMiddleware, the /callback route, sign-out, and the exact fix for the cookies-can-only-be-modified error.
- 7 Sept 2026explainer10 min read
Subscription fraud: stolen cards, trial churn, shared seats
Subscription fraud is three attacks with one name. How stolen-card trials, trial-to-chargeback and shared seats differ, and which event exposes each one.
- 7 Sept 2026how-to13 min read
Stripe webhook signature verification without the raw-body bug
Stripe webhook signature verification fails when a body parser rewrites the bytes. Raw-body fix for Express and Next.js, plus replay and retry handling.
- 7 Sept 2026how-to10 min read
Stripe test mode: cards, clocks, disputes, and webhooks
A working sequence for Stripe test mode: which test card fires which decline, how to land a dispute, advance a trial with a test clock, forward webhooks.
- 7 Sept 2026how-to12 min read
Stripe SetupIntent trials and the $0 auth that leaks
Save a card at trial start with a Stripe SetupIntent, charge it off-session when the trial ends, and stop the card testing a card-on-file form invites.
- 7 Sept 2026how-to13 min read
Writing Stripe Radar rules for a small SaaS
Stripe Radar rules syntax, evaluation order, and the traps that make a rule match nothing, with paste-ready block and review rules for a SaaS product.
- 7 Sept 2026how-to10 min read
Stripe metadata: link every PaymentIntent to your records
Stripe metadata is the join key between your database and Stripe. Write your ids at creation time, read them back in webhooks, and refund the right charge.
- 7 Sept 2026how-to12 min read
Stripe idempotency keys: what they dedupe and how to derive them
A Stripe idempotency key dedupes one request for 24 hours, not one order. Derive it from the attempt, handle the mismatch error, and stop double charges.
- 7 Sept 2026how-to10 min read
Turn a Stripe dispute webhook into fraud feedback
A Stripe dispute webhook that becomes fraud feedback: verify the signature, resolve the charge to a user, report the chargeback, and stop the next signup.
- 7 Sept 2026reference13 min read
Stripe decline codes, and which ones mean card testing
A lookup table of Stripe decline codes, what each means, what to show the customer, and the code mix that signals card testing rather than plain bad luck.
- 7 Sept 2026explainer10 min read
Return fraud: why the same person returns as a new account
Return fraud is an identity problem dressed as a policy problem. How wardrobing, empty-box claims and serial returners work, and how to link the repeaters.
- 7 Sept 2026how-to12 min read
Resend API from Node: verify, send, don't send twice
Wire the Resend API into Node: DNS records that verify a domain, a raw fetch send, idempotency keys so retries don't duplicate, and signed bounce webhooks.
- 7 Sept 2026explainer12 min read
Refund abuse in SaaS: write the policy first
Refund abuse in SaaS is usually a policy problem, not a detection one. How to bound a money-back guarantee and spot the same person on their second pass.
- 7 Sept 2026explainer12 min read
Real time fraud detection: what fits in 100 ms at checkout
Real time fraud detection is a latency budget plus a fail-open policy. What you can compute in under 100 ms, what belongs in a queue, and how to wire it.
- 7 Sept 2026explainer11 min read
Promo code abuse: why single-use codes don't stop it
Promo code abuse is a multi-account problem: why single-use codes, per-email limits and card gates fail, and how to link the accounts behind the farming.
- 7 Sept 2026how-to12 min read
Hono middleware: the onion model, with a screening example
How Hono middleware works: what await next() does to the response, where per-request state lives, why a Map counter lies on Workers, and safe timeouts.
- 7 Sept 2026explainer12 min read
First-party fraud: when the fraudster is your real customer
First-party fraud is your own customer abusing your product with their real name, real card, and real device. Why fraud scores miss it and what stops it.
- 7 Sept 2026explainer12 min read
Fake accounts: mostly one person, many identities
Most fake accounts are not bots. They are one person on their eleventh identity. How the three populations separate, and the queries that tell them apart.
- 7 Sept 2026how-to11 min read
Express rate limit: from the memory store to Redis
Set up an express rate limit in five lines, move the counter to Redis so it survives multiple instances, and key it on the API key instead of the raw IP.
- 7 Sept 2026how-to11 min read
Drizzle migrations on Railway Postgres, from generate to deploy
How drizzle migrations really work, where to run drizzle-kit migrate on Railway, why a redeploy skips your new SQL, and how to roll back with no down file.
- 7 Sept 2026how-to11 min read
How to detect card testing on Stripe before the PaymentIntent is created
Detect card testing on Stripe with a server-side check on the card fingerprint before you create the PaymentIntent, plus the webhook that refunds a deny.
- 7 Sept 2026how-to11 min read
Detect account takeover at login without locking users out
Detect account takeover at login with a Node risk check that steps up MFA on suspicious sign-ins and blocks only high-confidence attempts, not travelers.
- 7 Sept 2026how-to13 min read
How to add Cloudflare Turnstile to a signup form (and what it won't stop)
Add Cloudflare Turnstile to a signup form in an hour: widget modes, React render, siteverify in Node, the error codes, and the fake signups it cannot see.
- 7 Sept 2026explainer11 min read
A chargeback for fraud usually isn't: what Visa 10.4 means
A chargeback for fraud means the cardholder tapped 'I didn't authorize this.' What Visa 10.4 lets you argue, and the logging that decides it months ahead.
- 7 Sept 2026teardown9 min read
A card testing attack example: 75,000 cards, 28 days, zero sales
A card testing attack example from a public Hacker News thread: 75,000 tokens created in 28 days, no sales, no alert, and where the Radar bill comes from.
- 7 Sept 2026how-to12 min read
How to add device fingerprinting to a signup form
Add device fingerprinting to a signup form: collect a short-lived token in the browser, pass it through on the server, and prove the device key landed.
- 6 Sept 2026how-to12 min read
How to stop free trial abuse in a Next.js app
Stop free trial abuse in a Next.js app: screen the signup in an App Router route handler, collect a device token, and revoke denied accounts by webhook.
- 6 Sept 2026how-to11 min read
Handle a fraud review webhook and revoke an account
A fraud review webhook denies an account: verify the signature over the raw body, find the user, revoke idempotently, and answer 200 before the retry.
- 6 Sept 2026how-to10 min read
Express signup fraud middleware that fails open
Build Express signup fraud middleware that screens every signup in under 100 ms, fails open on timeout, and hands allow, review or block to your route.
- 5 Sept 2026explainer13 min read
Stripe chargebacks: what happens after the dispute lands
How Stripe chargebacks run from early fraud warning to lost funds, what the $15 fee covers, when evidence is worth it, and how to keep the disputer out.
- 5 Sept 2026explainer13 min read
Shopify chargebacks: what the fraud analysis saw, and what it didn't
How Shopify chargebacks work: the fee and when it comes back, which disputes you can win, what Shopify Protect covers, and how to stop the repeat offender.
- 5 Sept 2026explainer12 min read
PayPal chargebacks: what a seller can fight, and what they can't
PayPal chargebacks for software sellers: dispute vs claim vs issuer chargeback, the $15 and $20 fees, Seller Protection for intangibles, and repeat buyers.
- 5 Sept 2026explainer12 min read
Friendly fraud: why the customer disputes and how to win
Friendly fraud is a customer disputing a charge they authorized. What Visa CE 3.0 requires, which logs win a SaaS dispute, and how to stop the repeat.
- 5 Sept 2026checklist8 min read
Before you launch a free tier: the abuse checklist
Free tier abuse checklist for launch: meter expensive endpoints, capture identity keys, review before you block, fail open, and plan for the first attack.
- 5 Sept 2026explainer12 min read
Ecommerce fraud detection: match the signal to the attack
Ecommerce fraud detection is six different attacks. Name yours from the first loss, learn which signal catches it, and decide whether to build or buy it.
- 5 Sept 2026explainer13 min read
What credit card fraud detection datasets can't teach you
The public credit card fraud detection datasets model the bank's problem, not a SaaS checkout. What is in each one, and how to build the dataset you need.
- 5 Sept 2026explainer13 min read
BIN attacks: when card testers bring their own numbers
A BIN attack is card testing with generated numbers. How the Luhn check makes it cheap, why your decline codes help the attacker, and what stops it early.
- 5 Sept 2026explainer13 min read
Behavioral fraud detection: what a session can and can't prove
Behavioral fraud detection scores what a session does, not what it says. Which signals are cheap, which need a script, where behavior stops being proof.
- 3 Sept 2026explainer12 min read
x402 and the abuse problem nobody has priced in yet
x402 lets any script with a wallet pay your API per request. What the protocol does, what sellers lose without the card, and how to count abuse per wallet.
- 3 Sept 2026explainer13 min read
Velocity checks: what to count, and what to key it on
Velocity checks are counts per key per window. Which keys to use at signup, checkout, and login, why per-IP can only review, and a Redis sliding window.
- 3 Sept 2026explainer13 min read
Stripe Radar: what it catches, what it misses, what to add
What Stripe Radar screens by default, what the paid tiers add, the rules worth writing, and the signup, trial, and login abuse it structurally cannot see.
- 3 Sept 2026explainer12 min read
Free trial abuse: why blocking emails fails and what works
Free trial abuse explained from the abuser's side: why email blocklists, IP limits and card gates each fail, and how identity linking stops repeat trials.
- 3 Sept 2026explainer13 min read
Free tier abuse: how credit farming works and how to stop it
Free tier abuse explained: how scripted signups farm AI credits for resale, what each fake account costs you, and why to meter new clusters, not the door.
- 3 Sept 2026explainer13 min read
Fraud detection API options for SaaS: Radar, Sift, Fingerprint, and the self-serve gap
A fraud detection API landscape for small SaaS: what Stripe Radar, Sift, Fingerprint, Castle, hCaptcha and WorkOS Radar cover, what they cost, and the gap.
- 3 Sept 2026explainer12 min read
Disposable email domains: what a blocklist misses
Blocklists of disposable email domains catch the lazy tier and miss $1 catch-all domains and Gmail alts. Score email quality without blocking customers.
- 3 Sept 2026explainer13 min read
Device fingerprinting for fraud: what it can and can't do
How device fingerprinting works, where browsers break it, what the law requires, and why the device key lets you block card testing at ordinary amounts.
- 3 Sept 2026explainer12 min read
Chargeback fraud in SaaS: three kinds, one repeat offender
Chargeback fraud in SaaS: true fraud vs friendly fraud vs first-party abuse, Stripe fees, network thresholds, evidence that wins, and stopping repeats.
- 3 Sept 2026explainer12 min read
What is card testing? The fraud behind the $1 charges
Card testing is how criminals validate stolen cards on your checkout. How the probes work, what they cost in fees and disputes, and how to detect them.
- 3 Sept 2026explainer12 min read
Agent payments: abuse control when your customer is a bot
Agent payments break bot detection because the buyer is a bot. Use identity, reputation, velocity and price to tell paying agents from abusive scripts.
- 3 Sept 2026explainer12 min read
Account takeover detection that doesn't lock out real users
How account takeover happens at a SaaS login, which signals separate a stolen credential from a traveling customer, and why a challenge beats a block.
- 2 Sept 2026explainer13 min read
Card testing on Stripe: how the attack works and how to stop it
Card testing on Stripe explained from the attacker's side: why your checkout is the target, what declines and disputes cost, and what to change tonight.