# Security Testing for Marketplaces and Stores

AgentProof tests marketplaces and online stores for changed prices, reused coupons, exposed orders and redirected seller payouts.

Marketplaces and online stores take orders, apply discounts and pay sellers. AgentProof checks that no buyer or seller can change a price, order or payout that is not theirs, and fixes your code when one can.

## The Attack Agent tries to pay less, see other orders and move payouts.

- **PRICES** Can a buyer change the price or quantity of an item in the checkout request?
- **COUPONS** Can one coupon be used again and again, or on items it does not cover?
- **ORDERS** Can a buyer open another buyer's order, with their name and address?
- **LISTINGS** Can one seller edit or delete another seller's listings?
- **PAYOUTS** Can a seller change the bank account that another seller is paid into?
- **REFUNDS** Can a buyer get a refund for the same order twice?

Every one of these **costs you money or exposes a customer** if your app allows it.

## An example: the checkout charged the price that the browser sent.

Example finding: A buyer can set their own price at checkout

```
REQUEST
POST /api/checkout
Item 731, price sent as $0.01

RESPONSE
200 OK
Order paid at $0.01. The real price is $89.00.

FIX
+ const prices = await getPrices(items.map(item => item.id));
- const total = sum(items, item => item.price * item.qty);
+ const total = sum(items, item => prices[item.id] * item.qty);

RETEST
POST /api/checkout
Charged $89.00. Fixed.
```

The server now **looks up each price itself** and ignores the price in the request.

## Daily checks test new coupons and checkout changes within a day.

Stores change often. **Weekly or daily checks** test the store as it is now, not as it was at the last test.

## Questions marketplace and store teams ask, with answers.

- **Does this replace our payment provider's fraud checks?** No. Those check payments. AgentProof checks your own app's code: prices, coupons, orders, listings and payouts.
- **How do fixes reach our code?** You choose: a pull request your team reviews, an automatic merge after your checks pass, or a change applied straight to your running app.
- **Can the whole team see reports?** Yes. Invite as many teammates as you want at no extra cost. Reports go to your dashboard, email and Slack.

## One plan covers one marketplace or store with both agents.

Monthly checks cost $199 a month. **Weekly and daily checks cost $399 and $999 a month.**

- [See plans](/pricing/)
- [See what the Attack Agent does](/attack/)

## AgentProof also tests these kinds of apps.

- [SaaS](/solutions/saas/): Checks that each customer account can reach only its own data, roles and billing.
- [AI products](/solutions/ai/): Checks chats, shared links, model keys, usage limits and the tools your assistant can use.
- [Fintech](/solutions/fintech/): Checks accounts, transfers, amounts and approvals in apps that move money.
- [Health tech](/solutions/health-tech/): Checks that patients and staff see only the records they are allowed to see.
- [Apps built with AI tools](/solutions/ai-built-apps/): Checks database rules, exposed keys and unprotected routes in apps written with AI coding tools.

AgentProof is in development. The example finding on this page is an illustration, not a result from a customer's app.