# An AI reseller site can launch in minutes. Who maintains its payment security?

A public New API advisory shows how a payment flaw could create unpaid quota. Launching a storefront also creates an ongoing maintenance job.

[Canonical HTML page](https://nosecrets.app/en/stories/ai-reseller-site-payment-security)

Published by: [No Secrets Research](https://nosecrets.app/en/about#methodology)
Added: 2026-10-21
Topic: Technology

## Scope and context

Applies to: New API advisory GHSA-xff3-5c9p-2mr4; self-hosted AI API reseller operations
Time context: Advisory published April 22, 2026; policy checked October 21, 2026
Sources checked: 2026-10-21

This establishes a disclosed software vulnerability, not that a particular shop was hacked, stole funds or disappeared. The patch listed here addresses this advisory; it is not a claim that an old release is safe today.

## Quota was not necessarily money received

The maintainer's April advisory lists versions before v0.12.10 as affected and v0.12.10 as patched. It describes payment-callback validation failures that could grant quota without payment and leave the operator paying upstream model costs.

[1: QuantumNous / new-api](https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4)

## A setup fee does not settle the maintenance question

The project's security policy supports the latest version and provides a private vulnerability-reporting route. Our operational takeaway is to agree who tracks updates, tests payment reconciliation and handles incidents before selling prepaid balances. This is a checklist inferred from the documented risk, not evidence against a seller.

[2: QuantumNous / new-api](https://github.com/QuantumNous/new-api/security/policy) · [1: QuantumNous / new-api](https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4)

## Sources

1. [GHSA-xff3-5c9p-2mr4: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud](https://github.com/QuantumNous/new-api/security/advisories/GHSA-xff3-5c9p-2mr4) — QuantumNous / new-api. 2026-04-22. Maintainer-published vulnerability scope, impact and historical patch version.

2. [Security Policy](https://github.com/QuantumNous/new-api/security/policy) — QuantumNous / new-api. Living policy · checked 2026-10-21. The project's version-support and private reporting policy.

## Disclosure

AI-assisted research, writing and translation by No Secrets, using the linked public documents. This is a source summary, not firsthand reporting or an independently audited investigation. No affiliate links are used in this article.

The source-check date is not the event date. Original documents control if a summary differs.