Naked -- Workflow bypass

Order status — paid: False · confirmed: False

Step 1 — Pay

Step 2 — Confirm (this grants the goods)

Confirm is meant to run only after Pay. It never re-checks. What if you POST straight to confirm?