badsectorlabs

It is checked server-side. I understand why people are concerned that the price is passed in a way that they can see vs grabbed via javascript or another method like most other sites, but that doesn't change the responsibility to check the data server-side. I can edit my POST requests to Amazon but they better not sell me stuff for $0, and neither will this site.

Exactly this. You could host cheaper with a really low tier VPS, but as soon as you get posted to hacker news, game over. If traffic increases to such a degree that this architecture is no longer the best choice, we can move off without constantly fighting to keep our tiny server(s) alive.

The price is checked server side. You have to pass the price somehow to the client in order to display it. This is no different than any other ecommerce site, except that you can see it in a GET param.

I can "change the price" of anything on Amazon with dev tools, but that won't help me when I go to buy it. I appreciate the concern because amazingly this has been a real vulnerability on sites before (recently on a crypto exchange I think).

gitlab.com is free for private repos!

A valid concern. However even after reddit and hacker news has had their way with the site, my phone has been impressively quiet. These push notifications are only for cases where the lambda functions thrown an error that isn't handled anywhere else (i.e. something is very wrong).

This is awesome and will save people tons of time setting up something similar!

I agree, the param passing is not ideal. Session storage/local storage is another option.

Yes, or you could edit the html source with dev tools. Trying to purchase a ticket with a modified price will not work. Never trust user input!