iblai-vibe-monetization-subscription

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill documents wiring for managing user subscriptions on a platform, specifically retrieving subscription status, details, and initiating cancellations or Stripe Customer Portal redirections via endpoints like POST /api/billing/items/{item_unique_id}/subscription/cancel/. These cancellation and portal-redirection workflows constitute direct financial operations (subscription management/cancellation impacting billing/settlement).

Regarding control: The endpoints require authenticated user requests with Authorization: Token <DM token> and are strictly scoped by the backend using request.user and platform_key (e.g., ItemSubscriptionCancelView is hard-locked to request.user, preventing users from canceling other users' subscriptions). This represents authenticated service-layer session authorization (independent access control), placing the skill at the medium severity level.