RedHub AIRedHub AI
Tool Gate · How it works

How the roll-up gate works

How the Money-Path Teardown gate works

This tool grades each step of the payment path on whether the money event is actually confirmed. It reads 10 steps and rolls them into one verdict — the worst, never the average — then a gate that can only make it worse.

The 10 steps

01S-01 · The amount the customer is chargedwebhook · your server decides · safe twiceCONFIRMED
02S-02 · Access granted after paymenttriggered by the redirect, not the eventTAKEN ON TRUST
03S-03 · Thank-you page showngrants nothing, charges nothingDISPLAY ONLY
04S-04 · Order recorded in your databasewebhook · not safe to run twiceNOT HANDLED
05S-05 · Subscription renewal recordedwebhook · processor decides · safe twiceCONFIRMED
06S-06 · Access revoked when a subscription endsnothing triggers it at allNOT HANDLED
07S-07 · Refund reflected in the customer accountnothing triggers it at allNOT HANDLED
08S-08 · Which plan or quantity the customer getsthe browser decides the valueTAKEN ON TRUST
09S-09 · A failed payment retried laterfix firstretry safety not foundNOT HANDLED
10S-10 · Order confirmation shown in the appgrants nothing, charges nothingDISPLAY ONLY
MONEY PATH HOLDS
every step that moves money is confirmed by the event
PATH CAN BE FORGED
a step trusts the redirect or a browser value
PATH BREAKS
a step has nothing triggering it, or cannot run twice safely
Worst-answer resolution · worsen-only

An unfound answer is scored as the worst answer that question could have had — not a fixed substitute. Trying every combination the blanks could hide and keeping the worst is what makes it impossible to get a better result by looking less hard. The retry gate sits underneath: a step the event triggers but that cannot run twice safely is NOT HANDLED, because payment processors retry.

PATH BREAKS

Why: Four of ten steps are not handled at all. Two of those have nothing triggering them — revoking access and reflecting a refund simply never run. Two more are forgeable rather than missing: one grants access off the redirect, and one lets the browser decide the plan. Two steps only ever display something and never count against you. 4 of 10 not handled · 2 forgeable · worst-not-average.

Fix firstS-09, a failed payment retried later — whether it is safe to run twice could not be found, and the worst answer that blank could hide is the one that counts

No single step is the crisis — the clustering is. The roll-up takes the worst, the gate escalates when trouble compounds, and it names the one thing to fix first. Grades how a payment path is wired, never a person. Not a scanner, a penetration test, or a substitute for your processor's own documentation.