Spreedly Status

Postmortem: ### February 10, 2026 — Credits Referencing Capture Transactions Failing

‌High Level Summary

Between approximately 1:56 PM UTC and 4:15 PM UTC on February 5, 2026, credit transactions where the reference transaction was a capture failed with the error "The specified reference_token corresponds to a transaction which cannot be used as a reference."

What Happened

At approximately 1:56 PM UTC on February 5, 2026, Spreedly rolled out a change to support credits on the CyberSource Rest gateway. This included a change in the way we validated reference transaction types used in credits. Specifically, there was an unintended side-effect which caused captures to no longer be treated as a valid reference type for credits on gateways other than CyberSource Rest. Once this was discovered, the code was reverted at 4:01PM UTC. By 4:15 PM UTC, credit requests against captures were fully functional.

Next Steps

• Any credit attempts that failed with this error are safe to retry
• We are making improvements to our code review processes and regression test suite to ensure we catch similar errors before they make it into production
• We have identified a gap in our observability surrounding validation errors that we will be prioritizing

‌

-The Spreedly Team

Resolved: After monitoring the system post-deploy, we’re no longer seeing errors related to credits referencing Capture transactions, and processing has returned to normal.

Thank you for your patience.

Monitoring: We’ve deployed a revert to address the issue where credit transactions referencing Capture transactions were failing.

We’re actively monitoring to ensure credit requests referencing Captures are processing as expected. At this time, we’re not seeing further errors related to this behavior.

Investigating: We are currently investigating an issue where credit transactions referencing Capture transactions are failing in production.

Some customers may see errors when attempting to issue credits against Capture transactions. Capture transactions themselves are processing successfully.

Our engineering team is actively investigating this behavior to determine the cause and confirm whether this is a regression or an unintended change. We will provide updates as soon as more information is available.

Resolved: This incident has been resolved.

Monitoring: We are no longer seeing errors at this time, and the issue appears to have subsided. We are working with Payflow Pro to identify the root cause.

Our team continues to monitor the situation closely to ensure stability. Please continue to follow our StatusPage for the latest updates.

Investigating: Spreedly has detected an issue that is affecting multiple customers using Payflow Pro where some transactions fail with the error: “Invalid Request. Malicious string found in XML document”.

While we are providing an early notification in an effort to alert you as quickly as possible, we are still investigating the actual scope and impact and will provide an update as soon as more details are available.

Thank you for your patience.