alt Hacker NewsLots of space for vibe coding jokes here. And 504 is significant for Costa Rica, it can buy a lot of lattes.
On a more serious note, do these vibe coded chatbot payment UIs accept like one time use Revolut CC numbers?
And on a second serious note, have they heard of 3D secure or you simply can't pay with an european credit card?
Nottorp, don't be fooled, with Starbucks prices here in Costa Rica, $500 will barely get you a couple of weeks of lattes! Joke too :)
Going back to your serious notes, I successfully replicated the exact mechanics of this bug inside the Console, and it is a classic frontend race condition/bypass flaw:
When your system/keyboard is in a locale that uses commas, the input text box still physically allows you to type a dot (like typing 5.04 or 0.5). The catastrophic UX failure happens because if you press the "Enter" key immediately after typing, the form submits the raw, un-sanitized string to the backend before the frontend validation layer can intercept it, block it, or refresh the "Total due" box.
It completely bypasses its own validation rules (like the $5.00 minimum enforced minimum), skips any error prevention, and fires the single-click payment request to the gateway instantly with the misinterpreted value.
I uploaded the live replication screenshot here: https://ibb.co/HTY88MZ3