Find the failure before a buyer does.

Identity and session failures

1. Login methods create separate customer records.
2. OAuth callback domain differs from the deployed canonical domain.
3. Email verification can be replayed after first use.
4. Verification codes appear in logs, analytics or screenshots.
5. Password reset changes credentials without invalidating old sessions.
6. Role checks exist only in the browser.
7. A disabled identity provider still appears as an active button.
8. Account deletion detaches orders from the audit trail.

Catalog and order creation failures

9. The browser supplies the authoritative price.
10. Unknown SKUs can create valid orders.
11. Currency and amount are not validated together.
12. Quantity rules differ between product page and server.
13. Two clicks create two payable orders without idempotency.
14. Order reference changes between checkout and provider handoff.
15. Return and callback URLs are accepted from arbitrary origins.
16. Expired quotes remain payable.

Payment handoff and webhook failures

17. The return page marks an order paid from a query parameter.
18. Webhook signatures are not verified.
19. Webhook timestamps allow unlimited replay.
20. Event account or merchant ownership is not checked.
21. Provider amount and currency are not matched to the order.
22. Test-mode events can update live orders.
23. A provider success event is processed more than once.
24. The provider rail is shown before runtime credentials and callbacks are verified.
25. Payment failure erases the underlying order context.
26. Manual payment evidence is treated as automatic settlement proof.

Post-payment, refund and dispute failures

27. Entitlement is granted before the verified success event commits.
28. A refund request has no original payment reference.
29. Refund retries can issue money twice.
30. Dispute events are not attached to the order and customer.
31. Partial refund math ignores currency precision.
32. Operator overrides are not recorded with reason and actor.
33. Email notice is sent before the order transaction commits.
34. A failed callback is discarded instead of queued for retry.

Support, delivery and notification failures

35. Support tickets cannot locate the order by verified contact.
36. Robot answers expose account or payment data to an unverified user.
37. Sensitive refund, security or deletion cases never escalate to humans.
38. Delivery records use a different identifier from the order ledger.
39. Notification retries create duplicate customer messages.
40. Email From, Return-Path and authentication domains are misaligned.
41. A provider outage produces a generic blank screen.
42. Operators have no documented reconciliation or incident runbook.

Release, SEO and observability failures

43. Canonical, sitemap and internal links point to different URL versions.
44. Legacy public URLs return 200 duplicates instead of permanent redirects.
45. Private order or admin pages appear in the sitemap.
46. Structured data contains prices or claims not visible on the page.
47. Bot protection blocks verified search or AI crawlers without review.
48. Checkout starts are measured but successful order events are not.
49. Deployment has no versioned rollback and no evidence path.
50. Desktop passes while mobile actions overflow or become unreachable.

Primary sources and references

These links define platform behavior or security guidance. They are sources, not endorsements of TC SiteOS.

• Google Search Central: Canonical URL guidance
• Google Search Central: Build and submit a sitemap
• Google Search Central: Robots meta and data-nosnippet
• Google Search Central: Structured data introduction
• OpenAI: GPTBot, OAI-SearchBot and ChatGPT-User
• Perplexity: crawler documentation
• Bing Webmaster Tools: IndexNow
• Schema.org: Service
• Schema.org: BreadcrumbList
• OWASP: Authentication Cheat Sheet
• Stripe: Webhook documentation