Patrick Bass Area: Account (re-run) (audit p1r) · Surface: /account/credits/success · Dimension: law1-polish · Severity: major
On the page a customer lands on immediately after paying Stripe for a credit pack, the confirmation copy renders the literal string "they'''re yours" with three stray apostrophes. This is the first thing a paying customer sees after handing over money — a visibly broken sentence on a revenue-critical surface. Same class of stray-literal-quote defect already filed for the member directory, but a different surface and a worse context (payment confirmation).
Evidence
platform/templates/account/credits-success.php:18 and :22 both contain `refresh once and they'''re yours.` — verified via od -c showing bytes `t h e y ' ' ' r e` (three ASCII single-quotes). Both the with-packCredits and fallback branches have it, so the typo shows for every successful purchase.Suggested fix. Replace `they'''re` with `they're` (or a typographic apostrophe `they’re`) on both lines 18 and 22 of credits-success.php.
Filed by the automated tenant-app audit and adversarially evidence-verified. Status: verified. Open — not yet actioned.
Patrick Bass
@mobieus
