webmaxru Secure Payment Review
Review only the changed payment flow and report concrete findings with file and line references.
Required checks
- Represent money with Meridian's
Moneyvalue object; never use floating-point currency math. - Make checkout, capture, and refund retries idempotent by
paymentAttemptId. - Never log card data, authorization headers, access tokens, or raw payment-provider payloads.
- Validate state transitions before capture or refund operations.
- Treat timeouts as an unknown outcome until the provider confirms the transaction state.
Output
Return findings ordered by severity. For every finding, state the failure mode, the affected code,
and the smallest safe correction. Say No payment-safety findings when all required checks pass.