The same payment, credited twice.
The payment provider delivered one notice twice, the second while the first was still being handled. Each found the order still open, so each added the credits.
if (order?.status === "pending") { await fulfillCredits(session.customer, 500);Code as published in our audit of the sample app

