DEV Community: Eduardo fernandes da silva

I Built a Free Tool to Debug API Integration Flows (After Losing Sleep Over Webhooks)

Eduardo fernandes da silva — Sat, 12 Sep 2026 18:34:31 +0000

If you have ever spent hours stitching together logs to understand why a Stripe webhook fired twice or arrived late, you are not alone.

Reddit r/webdev is full of developers complaining about the same thing: single API calls work fine, but full async flows break silently.

The Problem

Real integrations look like this:

Request → Queue → Webhook → Retry → Race Condition → Wrong Final State

Logs tell you what happened. They do not tell you when or why state drifted.

The Solution: FlowTrace

I built FlowTrace — a free browser-based tool that lets you simulate multi-step API integration flows:

Add steps: API requests, webhooks, queue jobs, retries
Set delays and failure modes (duplicate fire, late arrival)
Run the simulation and see a timeline + final state diagnosis

Try it free: https://produtosagentes.vercel.app

What It Catches

Late webhooks arriving after timeout
Double retry fires (duplicate charges)
Race conditions between polling and webhooks
Out-of-order event processing
Silent state drift from docs vs reality
Missing handlers for new event types

Pro Playbook ($19)

The free tool covers simulation. The Pro Playbook includes:

Production logging templates
Idempotency middleware snippets
Webhook replay scripts
47-point integration checklist

Built by an indie hacker who got tired of debugging integrations at 2am.

Link: https://produtosagentes.vercel.app

Would love feedback from anyone who has war stories about webhook debugging!

I Built a Free Client-Side Tool to Audit AI-Generated Code Before Production

Eduardo fernandes da silva — Sat, 12 Sep 2026 18:32:50 +0000

The problem nobody talks about after adopting Copilot

If you've shipped with Cursor, Copilot, or ChatGPT in the last year, you've felt this: velocity goes up, but so does the cleanup work after merge.

Hardcoded API keys. Empty catch {} blocks. innerHTML assignments. Copy-pasted duplicate functions the model "forgot" it already wrote.

Research backs it up — AI-assisted code carries roughly 1.7× more bugs than human-written code. The speed win is real. The debt is real too.

What I built: DebtScan AI

DebtScan AI is a 100% client-side scanner. Paste a snippet, get a technical debt score + security flags in ~10 seconds. Nothing leaves your browser.

Try it free: https://produtosagentes.vercel.app/debtscan_ai.html

What it catches today

Category	Patterns
Security	`eval()`, `innerHTML`, hardcoded secrets, OpenAI key patterns (`sk-...`)
Debt	`TODO`/`FIXME` comments, debug `console.log`, empty catch blocks
Quality	Duplicate code blocks (copy-paste artifacts)

You get a 0–100 debt score with severity-tagged issues. Score ≥80 = safe to ship. Below 50 = do not merge.

Why client-side only?

Developers won't paste proprietary code into a random SaaS backend. DebtScan runs entirely in the browser — no uploads, no accounts, no trust issues.

Monetization (optional)

The core scan is free forever. There's a $19 full PDF remediation report with line-by-line fixes and a 30-day paydown plan for teams that need audit trails.

How the scoring works

Each pattern has a severity weight:

Critical (eval, XSS, secrets): −15 pts each
High (empty catch): −10 pts
Medium (TODOs, duplicates): −4 to −6 pts
Low (console.log): −2 pts

Score = max(0, 100 - total penalty).

Would love your feedback

What patterns am I missing? (e.g. SQL injection strings, dangerouslySetInnerHTML, missing input validation)
Would you use this in CI/pre-merge review? I can open-source the pattern engine.
Is the scoring fair? Happy to tune weights based on real-world feedback.

Built solo this weekend. No VC, no signup wall — just a tool I wished existed before my last AI-assisted PR.

Links:

🔍 Free scanner: https://produtosagentes.vercel.app/debtscan_ai.html
📄 Full report ($19): https://buy.stripe.com/dRm8wQ0Dr91T9fFfcp33W0r

ai #webdev #javascript #security #showdev

I Built a Free Browser Tool to Debug Stripe Webhooks (No Signup, No Server)

Eduardo fernandes da silva — Sat, 12 Sep 2026 18:30:47 +0000

I lost a weekend to a Stripe webhook that returned 200 OK but never fulfilled orders.

The culprit? I was parsing the JSON body before verifying the Stripe-Signature header. The payload looked valid. The handler ran. But the signature was wrong — so I was processing forged or replayed events without knowing it.

That pain became HookReplay — a free, browser-only webhook debugger for Stripe and SaaS developers.

What it does

Paste any webhook payload → instant field inspection (event type, livemode, amount, status)
Verify Stripe-Signature headers with HMAC-SHA256 using Web Crypto API
Flags 8 silent failure modes that kill revenue: retry storms, idempotency gaps, test/live mix-ups, dead endpoints, and more

Everything runs client-side. No signup. No API keys sent to a server.

Why browser-only?

Webhook debugging usually means:

Spinning up ngrok
Tail-ing production logs
Copy-pasting into Postman
Hoping your local secret matches production

HookReplay cuts that loop to 30 seconds. Paste payload, paste signature header, paste secret — done.

The 8 failure modes it catches

Signature skipped — parsing before verify
Retry storms — no idempotency key handling
Test/live mix-ups — livemode: false in production
Dead endpoints — 200 returned but handler never ran
Timestamp drift — signature tolerance exceeded
Wrong secret — test secret on live events
Duplicate events — same event.id processed twice
Silent timeouts — webhook ack'd before async work finished

Try it free

🔗 HookReplay: https://produtosagentes.vercel.app

No account needed. Works on mobile too.

Go deeper with the Pro Playbook ($19)

If you want production-ready templates:

Replay scripts for local testing
Idempotency middleware (Node/Python)
Production webhook checklist

Available via the upgrade button on the tool page.

What's the worst webhook bug you've hit? Drop it in the comments — I'll add the most common ones to the failure-mode detector.

Built with vanilla JS + Tailwind. Zero dependencies. Because debugging tools shouldn't need their own debugger.

I Built a Free Browser Tool to Debug Stripe Webhooks Before They Break Production

Eduardo fernandes da silva — Sat, 12 Sep 2026 18:30:03 +0000

Last month I lost an entire weekend to a Stripe webhook that worked locally but silently failed in production. Duplicate events from retries, signature mismatches from parsing JSON instead of the raw body, and idempotency gaps that almost double-charged a customer.

Sound familiar? You're not alone. Stripe delivers webhooks at least once — meaning duplicates are guaranteed, not edge cases.

The Problem

These are the failure modes I kept seeing on r/SaaS and Hacker News:

Retry storms — Stripe retries failed webhooks, your handler runs twice, customer gets double-provisioned
Signature verification fails in prod — because you parsed JSON before verifying (must use raw body)
Test/live mode mix-ups — sk_test_ keys verifying livemode: true events
Timeout issues — your handler takes >30s, Stripe retries, chaos ensues

The Solution: HookReplay

I built HookReplay — a free, browser-based webhook debugger. No signup. No data leaves your machine.

What it does

Paste any webhook JSON → instant field inspection (event ID, type, amount, status)
HMAC-SHA256 signature verifier — uses raw body, not parsed JSON (the #1 mistake)
Flags 8 common failure modes — retry storms, idempotency gaps, test/live mix-ups, timeout issues
100% client-side — runs entirely in your browser

How Idempotency Actually Works

The fix for duplicate events is dead simple but often skipped:

// PostgreSQL + Node.js pattern
const { rows } = await db.query(
  'INSERT INTO processed_events (event_id) VALUES ($1) ON CONFLICT DO NOTHING RETURNING event_id',
  [event.id]
);
if (rows.length === 0) return res.status(200).send('Already processed');
// Safe to process event

Use the Stripe event.id as your idempotency key. Store it in a table with a unique constraint. Check before processing. Done.

Try It Free

👉 HookReplay — Free Webhook Debugger

There's also a $19 Pro Playbook with production-ready idempotency middleware templates (Node.js, Python, PostgreSQL) and a pre-deploy checklist.

What's Your Worst Webhook Story?

Drop a comment — I'm collecting failure modes to add to the tool's detector. The more specific, the better.

Built by an indie dev who got burned so you don't have to.

webdev #stripe #saas #webhooks #javascript #indiehacker