paddle-subscription-update

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill documents implementing a Next.js Server Action that modifies Paddle subscriptions and initiates real-world charges (subscription upgrades and prorated payments via paddle.subscriptions.update()). This is a direct financial operation (charges/purchases/subscription modifications). Access control is enforced independently via server-side authentication (supabase.auth.getUser()) and database ownership verification matching the authenticated user to the customer record before executing the billing update.