Audit of 148 Razorpay webhook handlers finds 6% process payments twice

A developer reviewed 148 public Razorpay webhook handlers on GitHub: at least 9 (6%) re-run a non-idempotent side effect when the same event is redelivered, with 7 more unclear. Five of the nine change money-like values, such as crediting wallet coins on every payment.captured, and 9 handlers never verify the webhook signature.

• 9 of 148 handlers (6%) are non-idempotent on webhook redelivery
• 5 of the 9 change money-like values: wallet, amount_paid_paise, payouts
• 9 handlers (6%) never verify the Razorpay webhook signature
• Author released carbon-layer CLI to test retries and event ordering