payments
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFE
Full Analysis
- Webhook Signature Verification: The skill correctly instructs developers to verify the
stripe-signatureusing thestripe.webhooks.constructEventmethod. This is a fundamental security practice that ensures incoming webhook events originate from Stripe and have not been modified in transit. - Secure Environment Variable Management: The guidance clearly differentiates between server-side secrets (
STRIPE_SECRET_KEY,STRIPE_WEBHOOK_SECRET) and client-side publishable keys. It correctly utilizes theNEXT_PUBLIC_prefix for browser exposure, preventing accidental leakage of sensitive credentials. - Official Dependency Usage: The skill recommends standard, official packages from the Stripe ecosystem, such as
stripeand@stripe/stripe-js. These are well-established resources for payment processing. - Server-Side Logic Implementation: By promoting the use of Next.js Server Actions and API routes for session creation and fulfillment, the skill ensures that sensitive payment logic and API secret keys remain within the secure server environment, minimizing exposure to the client.
Audit Metadata