Security
What Paymob Payment Provider for Egypt can read and write, what it stores, and what leaves your instance.
Callbacks are verified, and an unverified one changes nothing
Every callback carries an HMAC. It is verified as HMAC-SHA512 over Paymob's documented twenty-field order, compared with hmac.compare_digest — constant time, so a forged signature's timing reveals nothing about how close it was.
A mismatch is logged and discarded. It never touches a transaction.
This matters more than it sounds. The webhook is a public route: anyone on the internet can post to it. Without signature verification, "this order is paid" would be something a stranger could assert.
The browser never decides the outcome
A customer can close the tab, lose signal, or edit the return URL. The return route only chooses which page to show them.
The transaction state comes from the signed server-to-server callback and nowhere else. Treating a browser redirect as proof of payment is how an order gets confirmed that nobody paid for.
Retries cannot confirm an order twice
Paymob retries callbacks. A repeat for a transaction already in its final state is ignored rather than reapplied.
The deliberate exception is a refund callback: a second refund on the same transaction is a real event, not a duplicate, and treating it as one would lose money.
Credentials
All four — secret key, public key, HMAC secret, integration ID — are base.group_system only, enforced by field-level groups.
No card number, token or billing payload is ever written to a log, at any level. Every outbound request has a timeout.
The environment guard
Saving a live key on a test provider is refused, and vice versa. Paymob uses one hostname for both and only the key distinguishes them, so this is a silent and expensive mistake otherwise — real cards charged in a rehearsal, or a real customer's payment sent to the sandbox.
Refunds are pending until confirmed
A refund is not marked done at submission. Reporting money as returned before Paymob confirms it would put a false figure in front of whoever reconciles.
What has not been verified
No payment has ever been taken through this module. There are no Paymob merchant credentials on the development account.
Verified over real HTTP against the documented payload shapes: HMAC verification including tampering, wrong secrets and field-order sensitivity; state derivation; duplicate and late callbacks; refunds; timeouts; connection errors; the credential guard. Not verified: acceptance by Paymob, a real checkout session, a real settled payment.
Run a sandbox payment before you take a real one.
Reporting a vulnerability
info@technovision.dev. We acknowledge within two business days.
Paymob is a trademark of its respective owner; this module is not affiliated with or endorsed by Paymob.