PayPal order amount is assembled in browser code
ShipReady found a client-side PayPal order shape with an inline purchase-unit amount.
Why it matters
A browser-side amount should be checked against trusted order data before fulfilment so a client cannot become the authority for what was purchased.
How ShipReady detects it
What it inspects
ShipReady reads page and fetched script text for a PayPal SDK marker together with a client-side order pattern containing purchase units and an inline amount value.
What triggers a finding
The rule triggers only when both the PayPal integration signal and the supported browser-side order pattern are present.
What the evidence shows
The observed client content includes a supported PayPal order construction pattern with an amount value.
Limits of this check
ShipReady does not create or capture an order, inspect a backend, or verify fulfilment logic. This pattern does not prove that a buyer can manipulate the paid amount or receive an entitlement incorrectly.
How to fix it
Create the authoritative order on the server
Build the order from trusted product and cart records on the server and return only the order identifier needed by the browser.
Verify before fulfilment
On capture, verify order status, amount, currency, and the expected purchaser or entitlement before delivery.
How to verify the change
Trace create, capture, and fulfilment
Confirm that the server calculates the expected amount and validates the provider response before granting access or shipping goods.
Expected: Fulfilment is based on a server-verified order, not a browser-supplied price.