stripe-security-audit
Installation
SKILL.md
Stripe Security Audit
Combines codebase scan + account settings review.
Codebase scan
Grep for leaked secrets: sk_live, sk_test, rk_live, whsec_, hardcoded keys outside env.
Checklist
| Area | Check |
|---|---|
| Secret keys | Only in env/secrets vault, never client or repo |
| Publishable key | pk_ only on client (safe) |
| Restricted keys | Used for scoped/agent access, least privilege |
| Webhook | whsec_ verified, not skipped |
| PCI scope | Using Checkout/Elements (SAQ-A), not raw card handling |
| Logging | No full card / secret / client_secret in logs |
| Key rotation | Old keys revoked in Dashboard |