stripe-security-audit
Audits Stripe security posture -- API key hygiene, restricted keys, secret leakage, PCI scope, and webhook signature verification. Use when the user mentions "Stripe security", "key management", "restricted keys", "secret leak", "PCI", or "is our Stripe setup secure".
Source facts
- Repository
- appeeky/stripe-skills
- Last source activity
- July 19, 2026 at 10:10
- Detected SKILL.md language
- English
- Stars
- 5
- Forks
- 1
Install options
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Review the source files
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Showing SKILL.md
SKILL.md
Source instructions · Read-only preview- name
- stripe-security-audit
- description
- Audits Stripe security posture -- API key hygiene, restricted keys, secret leakage, PCI scope, and webhook signature verification. Use when the user mentions "Stripe security", "key management", "restricted keys", "secret leak", "PCI", or "is our Stripe setup secure".
- metadata
- {"version":"1.0.0"}
# Stripe Security Audit
Combines codebase scan + account settings review.
## Codebase scan
Grep for leaked secrets: `sk_live`, `sk_test`, `rk_live`, `whsec_`, hardcoded keys outside env.
## Checklist
| Area | Check |
|------|-------|
| Secret keys | Only in env/secrets vault, never client or repo |
| Publishable key | `pk_` only on client (safe) |
| Restricted keys | Used for scoped/agent access, least privilege |
| Webhook | `whsec_` verified, not skipped |
| PCI scope | Using Checkout/Elements (SAQ-A), not raw card handling |
| Logging | No full card / secret / client_secret in logs |
| Key rotation | Old keys revoked in Dashboard |
## Output Template
```
Security Audit
Critical:
- [leaked/hardcoded key at file:line]
Harden:
- [use restricted key for X]
OK:
- [Checkout keeps PCI scope minimal]
Immediate: [rotate/remove any exposed key]
```
If a live secret key is found in the repo, advise **rotating it immediately** in the Dashboard.
View on GitHub