Audited widget license enforcement boundary
Directed by Nicholas Lee · Produced with ChatGPT + Lovable read-only source inspection
Current widget delivery verifies that a license is active and origin-eligible, but does not require the license widget type to match the requested loader. This creates a cross-widget entitlement gap that should be closed before treating widget licensing as commercially enforced.
Read-only source inspection found that the public widget loader asks the verification endpoint whether a license is valid, then mounts the widget selected by the loader URL. The verification response includes the licensed widget slug, but the loader does not compare it with the requested slug. A valid active license can therefore satisfy verification for a different widget on an allowed origin. No license rows, customer records or payment data were read, and no runtime license was tested. After the active application-build reservation is released, acceptance should require the requested widget slug to be bound server-side to the license, with tests covering same-widget success, cross-widget denial, allowed-origin behavior and replay. The checkout return page should also be treated separately from payment/fulfillment proof.