So it's your #2 priority then...
You never think "Do X every week" is going to be difficult to code, but man, when I actually coded that ... a lot of things can go wrong in subtle ways that you don't really consider in advance until a customer clicks something or uses features in a sequence nobody's ever stumbled onto before.
As for the credit card thing - easily explained as "Submitted info to Stripe, but not the actual form, backend system got confused"
MVP LYFE!
Disclaimer: I never worked at Gobble, I don't know if this is what's happening, but I painfully know how this can happen
Someone abandoning the checkout process is absolutely the first thing you should consider in advance.
There's a lot of things you should do, but the truth is that making modern async webapps with a million moving parts is hard.
I build modern async web apps for a living and it's not that hard. I ran eCommerce for a medium-size software company (as a part of my duties) for several years. If you find an ecommerce application difficult to maintain, it is probably a result of poor design.
HN has built in rate-limiting. Sometimes you have to wait for the reply button to show.
And there's eCommerce and then there's eCommerce. Recurring weekly subscriptions with moving parts are hard. Amazon Subscribe&Save is a mess and I haven't heard of anyone who's had a good experience with that. And Amazon probably devoted much more engineering power to that problem than people at a startup can.
Sometimes hardness isn't a result of poor design, but the result of things being complex. Especially if (as in a startup) your definition of "things" is changing rapidly because you're still not sure what exactly you are building.
If you are doing something so brain dead as charging customers who abandon the checkout process that means there is a huge problem with how you are running your shop. When you charge a CC you have to make absolutely SURE you get permission first, that's like really important. From a moral standpoint, a legal standpoint, and a "I want to keep my agreements with MasterCard/Visa/etc" standpoint.
I haven't dove down into fraud statutes too much but I'm going to go out on a limb and assume that when someone takes payment they have a legal obligation to verify the credit card holder actually authorized the payment they collect. At the very least Visa,etc,'s lawyers will care. There are also a whole bunch of other statutes that can apply too.
Issue a chargeback and report them, that's beyond shady.