Cursor
Cursor changed twelve files. One of them was the checkout.
An agent edit can fix the button and quietly break signature verification, the price id, or the redirect URL. The diff is too wide to trust by reading it.
Cursor is where a lot of these apps get their last-mile edits. The risk is not that the editor fails. The risk is that a correct-looking diff changes the one request a customer makes.
FunnelWatch's alert is a short prompt: the step, the URL, the expected price. Paste that back into Cursor instead of asking it to rediscover the bug from a blank chat.
What usually breaks
The route changed and the example env did not
The agent updated the checkout handler and left .env.example, and the deployed env, on the old variable names. Locally, your shell still exports the old names, so you cannot reproduce the production failure.
Signature verification that parses JSON first
A cleanup commit calls request.json() before constructEvent, or the equivalent HMAC check. The signature never matches because the raw bytes are gone. Stripe then looks like it is “not firing.”
Redirect URLs after a domain change
The app moved to a custom domain. Stripe success URLs, Supabase redirect allow-lists, and the OAuth callback still name the previous host.
Test keys deployed on purpose, once
A debugging session set the live service to test keys. The next edit did not touch that env screen, so production stayed in test mode and real cards are declined.
A button rename that is actually a deleted step
Copy edits are usually harmless. The same commit sometimes removes the element the script clicks. FunnelWatch stays quiet for a clear rename and alerts when the step is gone.
Watch the next break before a customer does.
Free checks the public URL. Pro replays the path after you verify the domain.