Fix · Payments

Customers could change the price in the browser before paying

UrgentSecurityKuwait and Gulf

What you may see

The price or total is sent from the page to the payment
An order was paid with a very small amount

Most likely cause

If the browser tells the server the amount, anyone can change it with simple tools; the server must work out the amount itself.

Check first (about two minutes)

Check what the checkout sends to the server: ids and quantities, or prices and totals?

The fix prompt

What you type here never leaves your browser. The search runs on this page, and nothing is sent to a server or to an AI.

The exact error or what you see

What you did before it happened

Kept only in this browser, on this device. Keys and passwords are removed before anything is saved.

Prompt language

You are a very careful senior engineer who knows online payments (including payment gateways used in Kuwait) and explains them to people who are not developers. I am not a developer, so explain every step in plain words and tell me exactly which button, menu or command you mean. If you are not sure about something, say so; do not guess.

This is urgent. Do the safety steps first, before anything else.

I am in Kuwait. If the service has a Kuwait or Gulf rule or option that matters here (for example KNET, Arabic right-to-left text or local time), take it into account.

THE PROBLEM
Customers could change the price in the browser before paying

THE EXACT ERROR OR WHAT I SEE
[paste the exact error here]

WHAT I DID BEFORE IT HAPPENED
[write in a few words what you did before it happened]

MOST LIKELY CAUSE
If the browser tells the server the amount, anyone can change it with simple tools; the server must work out the amount itself.

DO THESE STEPS, IN THIS ORDER
1. Review checkout and payment code. List every value taken from the browser that affects money (price, discount, delivery fee, tax, total).
2. Change it so the browser sends only product ids, quantities, options and a coupon code, and the server looks up prices and computes the total.
3. Compare the amount the gateway confirms to the server's total before marking paid.
4. Check recent paid orders for suspicious low totals and list them for me (read only).
Stop and tell me if what you see does not match a step. Do not skip ahead.

CHECK THAT IT WORKED
- Changing the price in the browser's tools has no effect on the amount charged.
Tell me exactly what I should see on the screen when it works.

DO NOT CHANGE
- Do not change real order data.
- Anything I did not ask about: the design, the text, other pages, other settings or the data.
- Do not delete files, data or branches, do not reset or force-push, and do not rewrite history, unless you first show me exactly what would be lost and I say yes.
- Do not paste, print or ask me to paste a password or secret key into this chat. If one is needed, tell me which settings page of the right service to store it in.

WHEN YOU FINISH
Explain in simple words what you changed (file by file or setting by setting), why you changed it, and how I can undo it.

Paste it into Claude, ChatGPT, Gemini or Cursor, then follow what it says.

After you tried it, did it work?

Steps

Review checkout and payment code. List every value taken from the browser that affects money (price, discount, delivery fee, tax, total).
Change it so the browser sends only product ids, quantities, options and a coupon code, and the server looks up prices and computes the total.
Compare the amount the gateway confirms to the server's total before marking paid.
Check recent paid orders for suspicious low totals and list them for me (read only).

Do not do this

Do not trust hidden form fields.
Do not change real order data.

Try another entry

Customers could change the price in the browser before paying

What you may see

Most likely cause

Check first (about two minutes)

The fix prompt

Steps

Do not do this

Related

How can we help?