...on a live site. It only applies if you use user upgrades. If you have debug mode enabled, someone could change the PayPal purchase URL to the sandbox, and use that to make the purchase. If you have debug mode enabled, the purchase will validate. Obviously obvious to see when its been done, but just putting it out there, because I'm bored.