fdc8cd4cff2c19e0d1022e78481ddf36

[nocturne sparrow]

What do you mean by shows it to a different user? Can you please elaborate?

[strange notch]

One user is logged in (lets say [e-mail]), has subscription_id as None. We try to fetch unpaid invoices for him, however it returns a link to pay the invoice for [e-mail] (different user)

[nocturne sparrow]

You're not filtering by customer

[strange notch]

When I try to run the same code locally, it returns an empty list (which is correct behavior)

I am

[nocturne sparrow]

So it will show all customers' invoices

Well the code you shared above isn't

[strange notch]

If I run it locally without specifying the subscription_id, it returns empty list (sending subscription_id=None)

If I run it on our server, it return the first invoice?

Not sure if this is meant to be like that

[nocturne sparrow]

When you run it locally, are you in test mode?

[strange notch]

No

I am in prod mode

[nocturne sparrow]

Can you share the request id's of both requests then?

[strange notch]

(using same secret + public key as on my prod server)