Case Study — When "Just Slap AI on It" Would Have Cost You Every Sale

Client: ValorHub (self-owned)

Live proof: The book is on sale at valorhub.eu. The payment and download flows below have been handling real money since May 2026.

Timeline: One week.

The pattern:

Payment verification checkpoint Real purchases flow from Lemon Squeezy through the checkpoint to n8n and are delivered. Fake purchases are rejected at the checkpoint. Lemon Squeezy real purchase Attacker forged webhook Checkpoint HMAC verify ~50 lines · edge Delivery flow n8n · email · file Customer receives book 401 rejected Real purchase — HMAC matches, delivery fires Forged request — no valid signature, rejected at edge
Fake purchase notifications never reach the delivery flow. The checkpoint verifies every webhook against a signature only Lemon Squeezy could have produced.

Why a solo operator should read this

You sell something digital direct from your site — a PDF, a course, a template, a licence. Two things are probably happening right now that you can't see:

Neither shows up as an error. That's what makes them expensive — you find out from a piracy site or a bookkeeping surprise, months later.

Both are common because the two default patterns — "trust the webhook, ship the file" and "email a direct link to the file" — are what every quick-start guide teaches. Nobody adds a checkpoint until they've been burned.

I fixed both on my own site. Two small checks. Once installed, they run themselves.

Fix 1 — verify every purchase is real

When a real customer pays, the provider sends a small message to my server: "purchase complete, deliver the product." Anyone with a laptop can send the same message pretending to be the provider. Unless my server checks who really sent it, the product ships to a stranger.

The fix has been standard practice for over a decade: every real message is cryptographically signed. My server re-computes what the signature should be for that specific message and compares. Match — deliver. Mismatch — reject. Fake purchases never touch the delivery logic.

Fix 2 — make shared links revocable

The download link contains a unique ID tied to one customer's purchase. On click, my server asks the database: "is this ID still valid?" Yes → serve the file. No → block. The customer's browser never sees the file's real address — only the checkpoint.

If a link ends up on Reddit tomorrow, I flip that one purchase to "revoked" and the link stops working. Every forwarded copy, every screenshot, every cached URL. One click.

The file itself lives in private storage that only my server can read. The customer never sees a URL to the file — only a URL to the check. That's the difference between "shared once, gone forever" and "shared once, revoked in seconds."

Download-link revocation A valid customer click travels to the checkpoint, which asks the database, then routes to the file. A revoked link takes the same path but the database returns no, and the checkpoint bounces to a 403 rejection. Paying customer clicks link Shared link already revoked Checkpoint asks database edge · < 100ms Database is order valid? EPUB delivered 302 → private storage 403 rejected Valid order — database says yes, file is served Revoked order — database says no, 403 without touching the file
Revocation is a database update, not a code deploy. A shared link stops working the moment the order is marked invalid — no waiting, no rebuild.

What working with me looks like

Clarity call — €300 (~60 min). For operators who want to know whether they need this at all before spending on a build. I look at your setup on a call, tell you which of the two checks (if any) you already have, and where the gaps are. Deliverable: a one-page written summary you can hand to any freelancer. If your setup is already fine, I tell you so and refund €150 — I'd rather have you keep the money than sell you something you don't need.

Install — €2,500–€3,500 (~1 week). Both checks installed on your live site, verified against real traffic, with a written runbook so you or anyone else can maintain it. One month of fake purchases on a €19 product silently costs €100–€300. One shared link on a forum with 20k members can eat 6–12 months of a small operator's revenue. This install stops both, once.

Contact: info@valorhub.eu · linkedin.com/in/maksymdonets · Munich (CET)