Issues

• [Security] PayPal handle_webhook marks a payment completed on any event whose type contains COMPLETED, without verifying the webhook signature

  nik2208/awesome-python-checkout#8 · Filter by author nb-camelot opened on Sep 27, 2026

• [Security] Satispay: webhook only POST, trusts body.status without signature or API re-read, digest in hex instead of base64, callback_url without payment id, refund endpoint mismatch

  nik2208/awesome-python-checkout#7 · Filter by author nb-camelot opened on Sep 27, 2026

• [Bug] PaymentResult.amount and currency are set only by create_payment: redirect, webhook, get_payment and execute results leave them None

  bug
  nik2208/awesome-python-checkout#6 · Filter by author nb-camelot opened on Sep 27, 2026

• [Feature] Nexi: notify_url → urlpost and a real handle_webhook (currently a stub returning pending)

  enhancement
  nik2208/awesome-python-checkout#5 · Filter by author nb-camelot opened on Sep 27, 2026

• [Bug] Nexi get_payment and execute_payment are stubs returning "pending": implement the XPay back-office situazioneOrdine look-up

  bug
  nik2208/awesome-python-checkout#4 · Filter by author nb-camelot opened on Sep 27, 2026

• [Security] Nexi: the outcome MAC is optional and compared with != (not constant time): GET /nexi/redirect?codTrans=X&esito=OK completes a payment

  nik2208/awesome-python-checkout#3 · Filter by author nb-camelot opened on Sep 27, 2026

• [Security] FastAPI router: the client body decides amount and order parameters; refund is always mounted without a guard (and the Nexi refund is a stub that reports success)

  nik2208/awesome-python-checkout#2 · Filter by author nb-camelot opened on Sep 27, 2026