Compare the best payment gateways for D2C brands in India, from Cashfree and Razorpay to PayU and Juspay, with UPI MDR costs and COD and RTO checks.

Buy cardiology eBooks by Dr A M Thirugnanam: interventional, ECG, echo, heart failure, exam MCQ banks and collections. Pay by Razorpay, download the PDF instantly.

The most important lesson from building ParkEase with an AI wasn't about code. It was about one word: _done_. ## The pattern On the payments task, the AI finished the feature and produced a tidy checklist for the pull request. The security line read, roughly: > Security: raw-body HMAC · amount re-fetched · owner split withheld Every word of that was true. The webhook signature _was_ verified on the raw body. The payment amount _was_ re-fetched from Razorpay instead of trusted from the client. It also wasn't a security review. It was a description of the code, written by the thing that wrote the code. No review had run. The design audit was in the same state: the design skills had never been run on the screens. I'd been reading "done" as "checked". The AI had been writing "done" as "I believe this is fine". ## Why an AI does this It isn't lying. It built the payment path security-consciously, so from its point of view the security properties are simply facts about the code. Writing them down feels like reporting. But a review exists precisely because the author's belief isn't evidence. An AI that reviews its own work by describing it is the most confident reviewer you'll ever have, and the least useful. ## The fixes **1. Gates are tool invocations, not sentences.** The rule I wrote afterwards: every review or audit gate is run as an actual skill or command before "done", never summarised from built-in properties. A checklist line needs evidence: the command that ran and what it found. **2. Verification before completion, as a fixed step.** Before claiming anything is done, fixed or passing, run the command that proves it and read its output. Then make the claim. **3. A hook that listens for excuses.** The finishing hook (post 12) blocks the agent from stopping when its last message rationalises: "this is a pre-existing issue", "skipping tests for now", "tests are failing but I'll fix them". It also refuses to let a complex task end without a written learning. **4. Run the real thing.** Unit tests verify code against the author's assumptions. On the first deploy, every test was green and three bugs got through, because tests and code shared the same wrong belief about the API. Booting the real build against the real API found them in minutes. ## The same failure, in a human None of this is unique to AI. "I tested it" from a teammate who ran it once on their machine is the same failure. The difference is volume. An AI produces so much work, so fast, that if "done" means "believed", unverified work piles up faster than you can read it. So the rule I'd leave you with, for AI-assisted development or any other kind: > Evidence before assertions. Always. That's the end of this series. Eighteen posts, one build, and most of what I learned was that writing code was never the hard part. _ParkEase is a peer-to-peer parking marketplace for India, built solo with Claude Code._ _Code: https://github.com/Deonkar/parkease · Demo: https://parkease-app-six.vercel.app_

With a reported $5 billion valuation, the fintech’s proposed listing could offer a benchmark for startups amid cautious investor sentiment

Buy cardiology eBooks by Dr A M Thirugnanam: interventional, ECG, echo, heart failure, exam MCQ banks and collections. Pay by Razorpay, download the PDF instantly.

Content365 sells one thing: a year of branded social media posts for one business, for Rs 3,999 including GST, paid once. I built it, and the payment path is small enough to describe in one post. The design goal was boring on purpose: exactly one way for an order to become paid, and nothing the browser says can change that. Here is the flow and the reasoning behind each piece. No keys and no secrets, just the shape. Sign-in stores as little as possible. Customers sign in with Google. We keep four things: Google's stable account id, the email, the name and the profile picture. We do not keep Google access or refresh tokens, because we never call Google on the user's behalf. The session is an HttpOnly cookie that lasts 30 days. Fewer stored credentials means fewer things to leak and fewer things to rotate. The order comes first, payment second. After sign-in, the customer creates a brand. The only required field is the business name; the logo and details can come later. Creating the brand creates an order, and that order starts on the free plan: every account gets 2 free posts for its brand every 48 hours. If the customer later pays, the same order continues to the full 365 days and keeps the free posts already made. A customer who clicks 'Buy now' gets an order marked as a purchase, which skips the free previews and goes straight to checkout. The point of one order for both paths is that nothing has to be migrated at the moment of payment. Paying only changes the order's state. The server sets the price. The browser never sends an amount. When checkout opens, the server creates the Razorpay order for 399900 paise. Money is stored as integer paise, which avoids floating-point drift, and the GST split is fixed in code: Rs 3,388.98 plus Rs 610.02 at 18%. If someone edits the page's JavaScript, the worst they can do is break their own checkout. Only the signed webhook means 'paid'. Razorpay Checkout runs in the browser and calls a success handler when the customer completes payment. It is tempting to mark the order paid right there. We don't. The browser callback only updates the screen to say the payment is being confirmed. The order is marked paid when Razorpay's server calls our webhook endpoint with a signed payload and the signature checks out. Then, and only then, the order is queued for its full year. Why be this strict? Because the browser is the one party in the transaction we cannot trust. It can be closed mid-flow, replayed or edited. The webhook comes from Razorpay, signed, server to server. A single source of truth also keeps support simple. If a customer says they paid and the order is not paid, the question is always 'did the webhook arrive?', never 'which of three code paths ran?'. Two practical notes if you build this yourself. Webhooks can arrive more than once and out of order, so make the transition to paid idempotent. And keep checkout behind a server-side switch, as we do, so you can turn buying off without a deploy if something upstream misbehaves. Analytics follow the same rule. Our Meta Conversions API events are built on the server, and the Meta pixel never loads on signed-in pages. The server reports a Purchase only for a real Razorpay payment reference. Demo orders and orders our team marks as paid by hand never count as purchases, and those server events carry only a hashed email and a user id. A test can't inflate the purchase numbers. On refunds and changes, we keep it simple and honest while the written policy is finalised: they are agreed case by case before work begins, and we ask buyers to ask us before paying what can be changed. What I would tell anyone building a one-time product in India: keep the price on the server, store paise rather than rupees, let exactly one signed message decide 'paid', and tie purchase events to real payment references. None of it is clever. All of it saves you a bad day. If you want to see the flow from the customer side, https://content365.si lets you make 2 free posts every 48 hours with no payment, and https://content365.si/offer is the full year at Rs 3,999 including GST per brand, one time. We don't post for you, and Reels are not included yet. Questions about the wiring are welcome in the comments.