SolveEase Pay — Security Guide

Threat Model & Mitigations

1. Amount Tampering

Threat: Malicious user modifies the amount on the frontend.
Mitigation: Amount is set exclusively at order creation (server-to-server). The browser never submits amount data — it only presents an order ID. Cashfree receives the amount from our backend, not the customer's browser.

2. API Key Compromise

Threat: Leaked API key used by attacker.
Mitigation:

  • Raw API keys are never stored — only bcrypt hash in DB
  • Key is provided once at creation; it cannot be retrieved, only rotated
  • Keys can be revoked instantly via the admin dashboard
  • All API requests are logged per-tenant for anomaly detection

3. Webhook Spoofing

Threat: Attacker sends fake Cashfree webhooks.
Mitigation:

  • All incoming webhooks from Cashfree are verified using HMAC-SHA256 with the Cashfree webhook secret
  • Signature check uses crypto.timingSafeEqual to prevent timing attacks
  • Idempotency: duplicate webhook events are ignored (order status is idempotent)

4. Tenant Isolation Breach

Threat: Tenant A accesses Tenant B's order.
Mitigation:

  • All order queries include tenantId filter derived from the authenticated API key
  • Even with a valid orderId, access is denied if it doesn't belong to the authenticated tenant

5. SQL Injection

Threat: Malicious input in query parameters.
Mitigation: Prisma ORM uses parameterised queries exclusively. No raw SQL with user input.

6. CORS Bypass

Threat: Unauthorized domain calls the API.
Mitigation:

  • CORS policy whitelists the tenant's registered domain
  • The API is Bearer-token authenticated (not cookie-based), so CORS doesn't protect against server-to-server calls — API key auth does

7. Rate Abuse / DDoS

Threat: Attacker floods the payment API.
Mitigation:

  • 100 order creations/min per tenant (enforced in middleware)
  • 300 status checks/min per tenant
  • Edge-level rate limiting via Next.js middleware

8. Replay Attacks on Webhooks

Threat: Captured webhook replayed to trigger duplicate actions.
Mitigation:

  • Each webhook event includes an orderId and timestamp
  • Gateway tracks processed webhook event IDs and rejects duplicates
  • Tenant implementations should be idempotent (see Integration Guide)

Security Checklist for Product Teams

Before going live, ensure your integration does:

  • Never expose the API key in frontend code or version control
  • Verify the x-solveease-signature on every incoming webhook
  • Store the webhook secret in environment variables
  • Use idempotency — check if subscription is already activated before re-activating
  • HTTPS only — your webhook endpoint must use HTTPS
  • Respond quickly — webhook endpoint must respond within 5 seconds

Security Contacts

Report vulnerabilities to: security@solveease.in

We follow responsible disclosure and respond within 48 hours.