stripe-security-audit
Audits Stripe security posture -- API key hygiene, restricted keys, secret leakage, PCI scope, and webhook signature verification. Use when the user mentions "Stripe security", "key management", "restricted keys", "secret leak", "PCI", or "is our Stripe setup secure".
Datos de origen
- Repositorio
- appeeky/stripe-skills
- Última actividad en el origen
- 19 de julio de 2026 a las 10:10
- Idioma detectado de SKILL.md
- inglés
- Estrellas
- 5
- Forks
- 1
Opciones de instalación
De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.
Revisa los archivos de origen
Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.
Mostrando SKILL.md
SKILL.md
Instrucciones de origen · Vista previa de solo lectura- name
- stripe-security-audit
- description
- Audits Stripe security posture -- API key hygiene, restricted keys, secret leakage, PCI scope, and webhook signature verification. Use when the user mentions "Stripe security", "key management", "restricted keys", "secret leak", "PCI", or "is our Stripe setup secure".
- metadata
- {"version":"1.0.0"}
# Stripe Security Audit
Combines codebase scan + account settings review.
## Codebase scan
Grep for leaked secrets: `sk_live`, `sk_test`, `rk_live`, `whsec_`, hardcoded keys outside env.
## Checklist
| Area | Check |
|------|-------|
| Secret keys | Only in env/secrets vault, never client or repo |
| Publishable key | `pk_` only on client (safe) |
| Restricted keys | Used for scoped/agent access, least privilege |
| Webhook | `whsec_` verified, not skipped |
| PCI scope | Using Checkout/Elements (SAQ-A), not raw card handling |
| Logging | No full card / secret / client_secret in logs |
| Key rotation | Old keys revoked in Dashboard |
## Output Template
```
Security Audit
Critical:
- [leaked/hardcoded key at file:line]
Harden:
- [use restricted key for X]
OK:
- [Checkout keeps PCI scope minimal]
Immediate: [rotate/remove any exposed key]
```
If a live secret key is found in the repo, advise **rotating it immediately** in the Dashboard.
Ver en GitHub