User reaches checkout page
  → force check runs immediately (no cache)
  → Webhook arrives with Score
  → Score < 40: show payment form
  → Score 40–69: require additional verification
  → Score 70+: decline or redirect to support

<!-- checkout.html -->
<script type="module">
  const mod = await import('https://cdn.shieldlabs.ai/snippet.js?publicKey=YOUR_PUBLIC_KEY');
  mod.forceCheckAuthenticatedUser(USER_HASHED_ID, (ip, requestId) => {
    document.getElementById('shield-request-id').value = requestId;
    console.log('Shield check initiated:', requestId);
  });
</script>

<form id="checkout-form">
  <input type="hidden" id="shield-request-id" name="shieldRequestId">
  <!-- payment fields -->
  <button type="submit">Pay</button>
</form>

app.post('/api/checkout', async (req, res) => {
  const { shieldRequestId, paymentData, userId } = req.body;

  // Wait up to 3 seconds for Shield score
  const shield = await waitForScore(shieldRequestId, 3000);
  const score = shield?.score ?? 0;

  if (score >= 100) {
    // Block — bot/automation
    await logFraudAttempt(userId, shield);
    return res.status(403).json({
      error: 'Payment declined. Please contact support.',
    });
  }

  if (score >= 40) {
    // Require extra verification
    return res.status(200).json({
      requiresVerification: true,
      reason: 'Additional verification required for this session.',
    });
  }

  // Clean session — proceed with payment
  return processPayment(paymentData, userId, res);
});

function analyzeCheckoutRisk(shield) {
  const signals = shield.signals.map(d => d.Description);
  const risks = [];

  if (signals.includes('Is proxy')) {
    risks.push('Proxy IP detected — high carding risk');
  }
  if (signals.some(s => s.startsWith('Fail by'))) {
    risks.push('Anti-detect browser detected');
  }
  if (signals.includes('Is abuser')) {
    risks.push('IP on abuse blacklist');
  }
  if (signals.includes('Stun is not checked')) {
    risks.push('Automated browser or UDP blocked');
  }

  return risks;
}