Donation page with Stripe Checkout on Replit, safe to publish?

Two things before live:

1. Your secret key is read on the server, good. But the webhook handler parses JSON before verifying the signature, so verification always fails in production. Read req.text() first.
2. The success page trusts ?session_id= from the URL to show 'thank you'. Confirm the payment server-side with checkout.sessions.retrieve before you thank anyone or unlock anything.