File: BACKEND/app.js (lines 66, 69)
Severity: LOW
Problem: app.use('/api', limiter) registers before the webhook route. Stripe sends webhook events that could be rate-limited if multiple events fire in quick succession, causing missed order processing.
Fix: Register the webhook route before the rate limiter, or exclude the webhook path from rate limiting.
File: BACKEND/app.js (lines 66, 69)
Severity: LOW
Problem: app.use('/api', limiter) registers before the webhook route. Stripe sends webhook events that could be rate-limited if multiple events fire in quick succession, causing missed order processing.
Fix: Register the webhook route before the rate limiter, or exclude the webhook path from rate limiting.