paddle-subscription-cancel

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill implements subscription cancellation and updates via the Paddle API (paddle.subscriptions.cancel and paddle.subscriptions.update), which are direct financial operations (modifying active subscription billing terms). These routes are secured by explicit authentication checks via Supabase (supabase.auth.getUser()) and database-backed ownership verification linking the authenticated user to the specific subscription (customer_id check), satisfying independent access control criteria.