Here’s how agents used the Northwind SDK this week
api-doctor watches 58 codebases that call northwind-node, rewrites the docs pages that taught them wrong, and opens the upgrade pull requests on their side.
Codebases integrated
58
+6PRs opened in user repos
22
13 mergedDocs commits merged
5
4 pagesAvg health score
61.4
+7.8 repeatMost implemented wrong
Top 6 of 12 rules, by codebases affected since install. Click a row for the pattern.
Webhooks accepted without signature check
Anyone who knows the URL can grant themselves a paid account
24 of 58
→Calls to a deprecated endpoint
Breaks when v1 is switched off
22 of 58
→Amounts passed as floats
Customers get charged a cent off — or 100x
21 of 58
→Charge result never checked
Declined cards get fulfilled as paid orders
19 of 58
→List calls that ignore pagination
Totals and exports silently stop at one page
17 of 58
→Charges with no idempotency key
A retried request charges the card twice
15 of 58
→Who wrote the broken code
Findings by authoring-agent signal, last 12 weeks.
Claude Code
34%
2.1 findings per 100 new call sites
Cursor
26%
2.9 findings per 100 new call sites
GitHub Copilot
18%
3.7 findings per 100 new call sites
No agent signal
14%
1.9 findings per 100 new call sites
Codex
8%
2.6 findings per 100 new call sites
Distribution
We ship your new SDK into their code
api-doctor is subscribed on 58 of your users' repos. When you publish, we open the pull request — only where it is needed.
Shipped for you
We shipped version 5.0.0 into your users’ codebases
You published northwind-node 5.0.0 12 days ago.
22
pull requests opened
13
merged — those users are on the new version
78
deprecated calls we found
46
of them already rewritten
What your users were still calling
The 5 deprecated surfaces version 5.0.0 removed or reshaped, and how much of each was still live.
webhooks.constructEvent(body, sig, secret)
→ webhooks.constructEvent({ body, signature, secret })
28
in 22 codebases
17 rewritten
refunds.list(chargeId)
→ refunds.list({ charge })
19
in 14 codebases
11 rewritten
refunds.createLegacy(charge, amount)
→ refunds.create({ charge, amount, reason })
12
in 12 codebases
7 rewritten
webhooks.verifyHeader(sig, secret)
→ webhooks.constructEvent({ … })
11
in 9 codebases
6 rewritten
refunds.retrieveForCharge(id)
→ refunds.retrieve(id)
8
in 7 codebases
5 rewritten
Which version your users are on
All 58 codebases by the northwind-node version they are pinned to — the day 5.0.0 shipped, and today. 4.6.x means any patch release of version 4.6. npm tells you downloads; this tells you who breaks when you sunset a version.
5.0.0
current0 → 19
13 of the 19 got here by merging a pull request we opened.
4.6.x
27 → 21
4.2.x
18 → 10
4.0.x
9 → 4
3.x
eol4 → 4
Frozen. Crossing two majors is not a mechanical rewrite, so we did not try.
4 codebases are still on version 3.x. Sunset it this quarter and all 4 break — and not one can be moved by a codemod.
Who we left alone
36 of 58 — no version bump they did not need
24
5.0.0 changes nothing they wrote
6
Already on 5.0.0
4
Pinned to 3.x
2
Automated PRs turned off
Share of new codebases where the rule fired
▼17ptsPercent of newly scanned codebases where the rule fired that week. Each vertical marker is one of your docs commits, scored on its own.
webhook-signature-unverified
amount-as-float
docs commit
Docs fix · already drafted
We wrote a fix for your documentation
One page on your docs site is teaching this mistake. api-doctor drafted the edit — review it and it opens as a pull request on your docs repo.
The signature warning exists, but it sits below the fold in the Express example and after the JSON-parsing snippet people copy first. Two recurring threads post-date it — covered is not the same as working. This callout moves the warning to the top of the handler example, where the body parser is chosen.
docs page docs/content/guides/webhooks/receiving-events.mdx
docs repo northwind/northwind-node
fixes rule northwind-webhook-signature-unverified
commit docs(webhooks): CAUTION — parse the raw body, then verify the signature
The change to your docs page
+ > [!CAUTION]
+ > Never trust an unverified webhook body. Mount the route with
+ > `express.raw({ type: "application/json" })` and pass that buffer to
+ > `northwind.webhooks.constructEvent(body, signature, secret)`.
+ > A JSON-parsed body will fail verification — fix the parser, not the check.The signature rule still fires in 11% of newly scanned codebases. If this merges this week, api-doctor scores it against the next eight weeks of new commits — the same way it scored the five markers on the chart above.
What developers are saying
Sample threads from your support surfaces, matched to rules.
northwind · GitHub Discussions · Feb 2025
Do I really need constructEvent, or can I just parse the JSON body?↻ recurring — docs not landing
northwind · Discord · Sep 2025
Signature check fails after adding express.json() — should I drop it?↻ recurring — docs not landing
northwind · GitHub Discussions · Nov 2024
charges.create rounds 19.99 to 1999 sometimes and 1998 other times✓ caught by amount-as-float
northwind · Discord · Jun 2025
Duplicate fulfillment emails when a webhook is redelivered○ no rule yet — draft one below