Live config Live API key, store ID, variant ID, and production env are set outside public code.

No key values should appear in logs, commits, reports, screenshots, or public pages.

Published variant Production variant is published and configured for the intended product.

Use a real published variant, not a stale test-mode checkout or copied historical URL.

Price and currency Checkout price matches CN¥69.00 without forcing a mismatched currency.

Record minor units, store currency policy, and whether custom pricing is disabled or intentionally used.

PayPal checkout PayPal checkout renders from the production checkout URL.

Do not submit a payment during this report unless the owner is intentionally running a live smoke test.

Signed webhook A paid production event reaches the deployed webhook route and passes x-signature verification.

Use only event IDs or redacted references in public notes.

Duplicate replay Replaying the same paid event runs fulfillment side effects exactly once.

This covers duplicate emails, duplicate license grants, duplicate ZIP delivery, and repeated entitlement writes.

Private delivery Buyer delivery uses a private ZIP or private license path with checksum evidence.

The paid archive should not be published in GitHub Pages or a public release asset.

Refund rollback Refund or chargeback events revoke or annotate access once, with support notes.

Rollback behavior should be repeat-safe and not expose customer data in public reports.

Support path Delivery, resend, duplicate purchase, broken archive, and refund boundaries are documented.

Link a buyer-facing policy page before checkout is shared.

Release evidence Checkout smoke, event coverage, fulfillment, refund, and email reports are attached to release review.

Keep the evidence packet secret-free and suitable for PR review.

Lemon Squeezy production checkout readiness report