A signed payment can still unlock the wrong thing

A valid signature tells you where a payment notification came from. Your app still has to decide what that payment buys.

In your sandbox, try changing the checkout amount, product ID or account reference.

The server should own pricing and bind the checkout to the authenticated buyer. Before granting access, match the payment status, currency and purchased product to the stored order, accounting for legitimate discounts and taxes.

Also test environment separation. A test-mode payment must never unlock live access.

Custom fields inside a signed notification may originally have come from the browser. A valid signature doesn't make those fields trustworthy.