Skip to content

feat(bounties): fund bounties through CoinPay checkout sessions (stack 0.5.0) - #95

Merged
ralyodio merged 1 commit into
masterfrom
feat/coinpay-checkout-sessions
Oct 21, 2026
Merged

ralyodio merged 1 commit into
masterfrom
feat/coinpay-checkout-sessions

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Bounty funding uses CoinPay hosted checkout sessions via @profullstack/stack 0.5.0: buyer picks any coin c0upons has a wallet for, or PayPal. Sends customer_email (CoinPay login profile email, else a new form field), account_id (the DID), property c0upons.com. payment_id holds the cs_ id until the webhook stores the paid payment id; the bounty page links /checkout/<cs_id>. Webhook moves to verifyAndReadCoinPayWebhook (paid = confirmed/forwarded, PayPal included). bun test 80 pass, tsc and next build clean.

🤖 Generated with Claude Code

…k 0.5.0)

Bounty funding now creates a hosted checkout session (any wallet coin or
PayPal) with the payer email, the DID as account_id and property
c0upons.com. Email comes from the CoinPay login profile, else the form.
The webhook uses verifyAndReadCoinPayWebhook and its paid flag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​profullstack/​stack@​0.1.3 ⏵ 0.5.080 +810084 +193 +7100

View full report

@socket-security

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority Alert  (click "▶" to expand/collapse) Action
Low priority
Low adoption: npm @profullstack/stack

Location: Package overview

From: apps/web/package.json → npm/@profullstack/stack@0.5.0

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@profullstack/stack@0.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn

View full report

await db.sql`UPDATE bounties SET payment_id = ${paymentId} WHERE public_id = ${publicId}`;
sessionId = checkout.sessionId;
payUrl = checkout.checkoutUrl;
await db.sql`UPDATE bounties SET payment_id = ${sessionId} WHERE public_id = ${publicId}`;
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

38 finding(s)

MEDIUM: 32 | LOW: 6

Severity Rule Location
MEDIUM sql-template-interpolation apps/web/app/api/bounties/[id]/claim/route.ts:18
MEDIUM sql-template-interpolation apps/web/app/api/bounties/[id]/claim/route.ts:34
MEDIUM sql-template-interpolation apps/web/app/api/bounties/[id]/claim/route.ts:43
MEDIUM sql-template-interpolation apps/web/app/api/bounties/route.ts:95
MEDIUM sql-template-interpolation apps/web/app/api/coupons/route.ts:68
MEDIUM sql-template-interpolation apps/web/app/api/coupons/route.ts:75
MEDIUM sql-template-interpolation apps/web/app/api/coupons/vote/route.ts:31
MEDIUM sql-template-interpolation apps/web/app/api/coupons/vote/route.ts:33
MEDIUM sql-template-interpolation apps/web/app/api/stores/[slug]/route.ts:9
MEDIUM sql-template-interpolation apps/web/app/api/webhooks/crawlproof/route.ts:83
MEDIUM sql-template-interpolation apps/web/app/api/webhooks/crawlproof/route.ts:90
MEDIUM js-open-redirect apps/web/app/bounties/new/page.tsx:61
MEDIUM js-unescaped-html-sink apps/web/app/coupons/[id]/page.tsx:57
MEDIUM js-unescaped-html-sink apps/web/app/layout.tsx:89
MEDIUM sql-template-interpolation apps/web/app/stores/[slug]/page.tsx:16
MEDIUM js-unescaped-html-sink apps/web/components/PitFooter.tsx:24
MEDIUM sql-template-interpolation apps/web/lib/bbs-post.ts:164
MEDIUM sql-template-interpolation apps/web/lib/flipp-sync.ts:445
MEDIUM sql-template-interpolation apps/web/lib/inbound-email.ts:573
MEDIUM sql-template-interpolation apps/web/lib/inbound-email.ts:643
MEDIUM sql-template-interpolation apps/web/lib/mcp-tools.ts:81
MEDIUM sql-template-interpolation apps/web/lib/members.ts:54
MEDIUM sql-template-interpolation apps/web/lib/nichedb-sync.ts:186
MEDIUM sql-template-interpolation apps/web/lib/nichedb-sync.ts:206
MEDIUM sql-template-interpolation apps/web/lib/reddit-sync.ts:336
MEDIUM sql-template-interpolation apps/web/lib/reddit-sync.ts:355
MEDIUM sql-template-interpolation apps/web/lib/reddit-sync.ts:361
MEDIUM sql-template-interpolation apps/web/lib/reveal-coupon.ts:115
MEDIUM sql-template-interpolation apps/web/lib/reveal-coupon.ts:170
MEDIUM sh-predictable-temp-path apps/web/public/install.sh:37
MEDIUM sh-predictable-temp-path apps/web/public/install.sh:39
MEDIUM sql-template-interpolation apps/web/scripts/migrate.mjs:192
LOW sql-template-interpolation test/bbs-post.test.mjs:129
LOW sql-template-interpolation test/bbs-post.test.mjs:143
LOW sql-template-interpolation test/bbs-post.test.mjs:164
LOW sql-template-interpolation test/inbound-email.test.mjs:139
LOW sql-template-interpolation test/reveal-sweep.test.mjs:69
LOW sql-template-interpolation test/reveal-sweep.test.mjs:112

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 5c74a7a into master Oct 21, 2026
5 checks passed
@ralyodio
ralyodio deleted the feat/coinpay-checkout-sessions branch October 21, 2026 13:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants