Hi Parakeet AI team,
I'm a paying-tier user and came across what looks like a validation bug in the checkout flow. Sharing it privately rather than anywhere public, since it has a security angle.
What happens
On /dashboard/buyCredits, the discount code field appears to evaluate input as you type, and it matches on a partial prefix rather than the full code.
On the monthly tier, typing into the Discount or Referral Code field:
"BANG" → $99.90 / ₹9,470
"BANGL" → $49.95 / ₹4,735
Same plan, same session — the only change is one additional character. The price halves at five characters. The full code is BANGLADESH25.
Why it matters
Two things:
Because the price updates live and matches on a prefix, any active promo code can be recovered character by character. Type a single letter, watch whether the price moves, keep the letter that works, repeat. That maps the full coupon table in a few hundred keystrokes, including codes meant for specific partners or campaigns.
The discount applied is 50%, though the code name suggests 25%. Either the coupon is misconfigured, or the partial match is resolving to a different coupon than intended.
Likely cause
The lookup is probably using a prefix or LIKE-style comparison instead of an exact match. Worth checking whether the same lookup is used in the referral-code path.
Screenshots of both states are attached. I stopped at observing the price change and didn't complete any transaction or attempt to enumerate further. I'll hold off mentioning this publicly until you've had a chance to fix it.
Best Regards
