Checks · PAY-005

PAY-005 · Stripe live secret in frontend

Why it matters

A live secret key in the browser can create charges and read your Stripe account.

How we detect it

The public bundle contains a live secret key format.

How we fix it

Remove it from client code, rotate it in Stripe, and call Stripe only from the server.

Can it be fixed automatically? With review

Related checks

• PAY-001 · Stripe webhook without signature verification
• PAY-002 · Price or amount taken from client
• PAY-003 · Paid access granted on redirect not webhook
• PAY-004 · Webhook handler not idempotent