This is a purchase-interception walkthrough, not a software project
gpt_sub_analysis has no library, command-line program, or service to install. Its root contains 3 Markdown documents plus a gitignore. The main README describes a way to observe an iOS purchase request and change subscription-related values before letting that request continue. The stated target is a ChatGPT subscription. That makes the repository closer to a procedural security note than an open-source product.
At commit 5e03334, there is no test harness, captured response bundle, isolated demonstration server, or code that a reviewer can inspect for control flow. A disclaimer says the material is for learning and research, but the procedure still points at a live commercial purchase system. Authorization and target choice remain the reader's responsibility. A long set of screenshots and settings does not prove the claimed result.
The Chinese documentation has no English companion
All 3 substantive documents are written in Chinese, and the GitHub repository has no detected programming language. The README is organized and specific about device setup, the proxy chain, and the claimed purchase flow. English-only readers do not get a translated guide, glossary, or short technical summary. Browser translation may convey the steps, but subtle security claims deserve better than machine-translated inference.
The repository was created on September 17, 2026, and its documents frame the work as analysis of subscription interception and transfer. Yet the public page mixes research framing with a celebratory success path and links to the author's other project and contact channels. A careful disclosure would separate the threat model, evidence, affected trust boundary, provider contact, current status, and safe reproduction against a test system.
What happened when we ran it
Our sandbox did not run commit 5e03334 because there is no supported ecosystem and no Dockerfile. The lab therefore has no install time, build result, test count, dependency footprint, or audit finding for this repository. A document cannot earn a passing software result merely because its instructions are detailed.
The repository has 0 tagged releases and no automated way to establish whether the described behavior worked at that commit. We did not send purchase requests, use accounts, bypass certificate checks, or test a paid service. Any claim that the procedure currently succeeds would need separate authorized evidence. The lab block supplies none, and no release freezes a known working state.
The setup weakens device protections before touching billing traffic
The README requires a jailbroken iOS device, 2 proxy applications on a computer, and tweaks that allow encrypted traffic to be inspected. It also asks for those tweaks to affect several system processes involved in account and network activity. Even on a device you own, that is a high-trust test environment with credentials and purchase data moving through an interception setup.
Issue 5 reports trouble injecting the certificate-bypass tweak into named processes, and issue 12 questions which iOS versions and device generations are feasible. These are not minor installation complaints. They affect whether the documented environment can be recreated at all. The README does not provide a compatibility matrix, rollback checklist, or procedure for proving that the device returns to a safe state afterward.
A security team can extract 1 useful question without copying the live procedure: does the application grant access from client-controlled request fields, or does a server verify signed transaction data and current entitlement state? Test that question with owned accounts, a mock purchase service where possible, and written permission. The repository does not supply those guardrails for you.
An open issue says the described path may already be closed
Issue 11, opened on September 19, 2026, says the method appeared to have stopped working. That is a user report rather than confirmation from Apple or OpenAI. It still matters because the repository was last pushed on September 18 and has no later release or README update resolving the report. A date stamped at the bottom of a guide cannot establish current behavior.
GitHub listed 613 stars and 12 open issues and pull requests when checked. The recent issue list is mostly user troubleshooting about regions, devices, account state, and whether the flow still works. There is no public maintainer response that turns those reports into a tested support table. Activity exists, but it does not amount to validation.
A security report needs evidence that survives after the trick stops working
Good security research remains useful when a vendor changes 1 endpoint. It identifies the trust mistake, shows bounded evidence, documents the affected versions, explains disclosure status, and gives defenders a way to verify the fix. gpt_sub_analysis mostly documents an operational sequence tied to one purchase flow. Once that flow changes, little remains besides the broad warning that client-visible billing traffic should not decide server-side access.
Use the repository as a lead for threat modeling, if you can read Chinese and have authorization to investigate your own application. Do not use it as billing advice, a current exploit claim, or proof that a provider accepts altered purchase data. With 0 executable tests and an issue questioning current viability, the responsible next step is a controlled lab built around systems you are permitted to test.