cmux-billing
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation and operational instructions for a billing integration, focusing on architectural maps and development workflows.
- [SAFE]: Hardcoded identifiers such as Stripe Product IDs (
prod_...) and Webhook IDs (we_...) are non-sensitive public references for testing environments, not secrets. - [SAFE]: Operational procedures correctly reference the use of environment variables (e.g.,
STRIPE_SECRET_KEY,DATABASE_URL) for secret management rather than hardcoding credentials. - [SAFE]: Architectural patterns described, such as Stripe webhook signature verification, follow security best practices.
- [SAFE]: All referenced scripts (e.g.,
dev-stack.sh,provision-live.sh) and tools (e.g.,bun) are local to the project environment.
Audit Metadata