AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 40 Bitcoin

[Feature] Monetization (#6986)

Public commit record

What the developer wrote

Authored by Nicolas Dorier

43/100 · Thin
[Feature] Monetization (#6986)
✓ Descriptive subject✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
The short version

What changed, and why it matters

This is a large feature commit titled 'Monetization' that adds subscription and paid-access functionality to BTCPay Server. It introduces new plugins for monetization and subscriptions, changes how user login restrictions are enforced, adds a 'limited login' authentication scheme, and refactors user registration/invitation email flows. The changes touch authentication, authorization, billing, and user lifecycle logic. While the commit is framed as a feature, several areas have security implications: a new limited-login path that signs users in under a separate scheme when normal login is blocked, changes to password-reset and invitation-token handling, and new database entities for plans/subscribers/portal sessions. No explicit security bug is visible in the diff, but the breadth and sensitivity of the modified code means defects could have significant consequences.

Recommended action

Treat this as a high-sensitivity feature commit requiring focused security review of the new authentication/authorization paths before release. Specifically audit: (1) the LimitedLogin scheme to ensure it cannot be used to bypass normal access controls or elevate privileges; (2) the MonetizationHostedService and entitlements logic to confirm users are correctly locked out when subscriptions expire or entitlements are removed; (3) the refactored UserEvent/invitation and password-reset flows for token-reuse or account-takeover issues; (4) the new subscription checkout and portal session endpoints for injection, IDOR, or payment bypass; and (5) the BaseUrl validation to prevent open redirects or SSRF. Run integration tests covering lockout, downgrade, suspension, and re-activation scenarios.

Security signals we found

01

New authentication scheme 'LimitedLogin' introduced and used in login path

02

Login controller signs in users under LimitedLogin scheme when normal access is denied

03

Password reset and invitation token handling changed

04

User registration/invitation event creation refactored

05

New subscription/plan/entitlement/subscriber/portal-session data model added

06

CanLogin policy checks now gate registration and password-set flows

07

BaseUrl setting added to server branding with URL validation

08

SetAdditionalData marked obsolete due to race-condition risk

09

TextTemplate encoding hook added to all replacements

Risk score

Why this scored 40/100

Our methodology →
Potential impact 8/30
Exploitability 7/25
Stealth signal 6/15
Affected reach 10/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.