AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 27 Bitcoin

[Features] Subscriptions

Public commit record

What the developer wrote

Authored by nicolas.dorier

18/100 · Opaque
[Features] Subscriptions
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body
The short version

What changed, and why it matters

This is a large feature commit adding a new Subscriptions system to BTCPay Server. It introduces new database tables, models, UI pages, API permissions, webhooks, and business logic for managing subscription plans, subscribers, customer identities, checkouts, and portal sessions. There is no explicit security fix or vulnerability disclosure in the commit message or diff. The change is a feature addition, not a documented security patch.

Recommended action

Treat this as a normal feature commit. Review the new subscription controllers and permission checks for authorization consistency, validate raw SQL helpers for injection safety, and ensure cascade delete behaviors match intended data retention policies. No immediate security patch action is indicated by the provided materials.

Security signals we found

01

New authorization permissions added (CanViewMembership, CanModifyMembership)

02

New database entities with foreign keys and cascade/delete behaviors

03

Raw SQL via Dapper used for customer/subscriber upserts

04

New webhook event types for subscription lifecycle

05

New customer identity and subscription checkout data models

06

Large feature commit with many new controllers and views

Risk score

Why this scored 27/100

Our methodology →
Potential impact 5/30
Exploitability 5/25
Stealth signal 5/15
Affected reach 5/15
Confidence 5/10
Evidence quality 2/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.