backend

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The document describes explicit, payment-related RevenueCat server APIs and operations: it requires a secret server API key and shows specific endpoints to read subscriber purchase state (GET /v1/subscribers/{app_user_id}) and to grant or revoke promotional entitlements (POST /v1/subscribers/{app_user_id}/entitlements/{entitlement_id}/promotional and .../revoke_promotionals). It also covers webhook handling for purchases, renewals, cancellations. These are specific subscription/payment-management APIs (server-side actions that change entitlement/payment state), not generic tooling, so the skill grants direct financial/subscription execution authority.