stripe-security-audit
Audits Stripe security posture -- API key hygiene, restricted keys, secret leakage, PCI scope, and webhook signature verification. Use when the user mentions "Stripe security", "key management", "restricted keys", "secret leak", "PCI", or "is our Stripe setup secure".
Informations de source
- Dépôt
- appeeky/stripe-skills
- Dernière activité de la source
- 19 juillet 2026 à 10:10
- Langue détectée de SKILL.md
- anglais
- Étoiles
- 5
- Forks
- 1
Options d'installation
Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.
Vérifiez les fichiers source
Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.
Affichage de SKILL.md
SKILL.md
Instructions source · Aperçu en lecture seule- name
- stripe-security-audit
- description
- Audits Stripe security posture -- API key hygiene, restricted keys, secret leakage, PCI scope, and webhook signature verification. Use when the user mentions "Stripe security", "key management", "restricted keys", "secret leak", "PCI", or "is our Stripe setup secure".
- metadata
- {"version":"1.0.0"}
# Stripe Security Audit
Combines codebase scan + account settings review.
## Codebase scan
Grep for leaked secrets: `sk_live`, `sk_test`, `rk_live`, `whsec_`, hardcoded keys outside env.
## Checklist
| Area | Check |
|------|-------|
| Secret keys | Only in env/secrets vault, never client or repo |
| Publishable key | `pk_` only on client (safe) |
| Restricted keys | Used for scoped/agent access, least privilege |
| Webhook | `whsec_` verified, not skipped |
| PCI scope | Using Checkout/Elements (SAQ-A), not raw card handling |
| Logging | No full card / secret / client_secret in logs |
| Key rotation | Old keys revoked in Dashboard |
## Output Template
```
Security Audit
Critical:
- [leaked/hardcoded key at file:line]
Harden:
- [use restricted key for X]
OK:
- [Checkout keeps PCI scope minimal]
Immediate: [rotate/remove any exposed key]
```
If a live secret key is found in the repo, advise **rotating it immediately** in the Dashboard.
Voir sur GitHub