Matt Turley, Continuum. Updated November 5, 2026.
For founders running a custom storefront, a headless shop or a subscription box built with AI tools rather than on a hosted platform.
Anything the browser decides. If the price, discount or quantity comes from the page rather than the server, a customer can change it. After that: stock that oversells under simultaneous orders, orders created only if the success page loads, and refunds that change your records but not the payment.
A hosted shop platform has years of edge cases built in. A custom, AI-built store has the screens and the happy path, and meets each edge case for the first time in front of a customer: two people buying the last item, a card that needs extra authentication, a discount code used twice, a refund after shipping.
The most important rule is simple: the server decides money. The browser may display a price, but the amount that is charged must be computed on the server from your own product data, never taken from a form field.
Because several systems are involved (payments, inventory, email, shipping, a CRM), every order is a small distributed process, and processes of that kind fail in the gaps between systems.
How to tell Change a price, quantity or coupon value in the browser tools or in the request, and complete checkout. If the new amount is charged, the server trusts the client.
The fix Send only product ids and quantities. Look up prices and validate discounts on the server, then create the payment for the amount you computed.
How to tell Two checkouts for the last item both succeed. The code reads the stock count, then writes it later, so two requests can both read "1".
The fix Decrement stock in a single atomic database operation, or reserve it for a short time at checkout and release it when the reservation expires.
How to tell Paid orders are missing for customers who closed the tab. Fulfilment emails never send for those orders.
The fix Create and confirm the order from the payment provider's webhook. Our pages on webhooks that do not fire and orders missing from the CRM cover this.
How to tell Tax is a flat rate, shipping ignores weight or destination, or a currency is converted on the page. Totals differ from what you collect.
The fix Use a tax and shipping service or a payment provider's built-in tax calculation, compute totals on the server and test the countries you sell to.
How to tell A refund button updates the order status in your database without refunding the card, or the reverse. Stock is not returned and the customer is not told.
The fix Perform the refund through the payment provider, update the order from the resulting event and return stock and notify the customer in one flow.
How to tell Your code receives card numbers in a form field and passes them on. That moves the burden of card-data security onto you.
The fix Use the payment provider's hosted checkout or its secure card fields so card numbers never reach your server, which keeps your compliance scope small.
If you sell a few products and a hosted platform would meet your needs, use one. It is usually safer than custom code. Custom stores are justified when you need logic a platform cannot do, and they need the checks above.
A Ship Check reads the checkout, order and payment code and ranks what will lose money or orders first. A Ship Fix is the fixed-scope job if the order path needs rebuilding.
Ship Check, $299: A senior engineer reads your codebase and sends a written verdict (fine, fixable or rewrite), what will break first, a security and data read, and a costed plan, within 48 hours of repo access or it is free. It has a 7-day money-back and is credited against a Ship Fix. Or: See Ship Fix, $4,000 to $15,000.