A Success URL Is Not Proof of Payment

A payment provider's success URL is not proof of payment. An attacker can manipulate the URL to create fake entitlements. To fix this, move the authority to the server side, verifying payment events before creating entitlements. Run tests to ensure the fix works.