piighost/stripe-key

Name: piighost/stripe-key
License: https://opensource.org/licenses/MIT

Stripe secret or restricted key, in its live or test form. The test form is caught too: it is harmless on its own but reveals an account and usually travels with the live one.

Label: STRIPE_KEY

Pattern

\b[sr]k_(?:live|test)_[A-Za-z0-9]{24,}\b

Must be caught

STRIPE_SECRET_KEY=sk_test_abcdefghijklmnopqrstuvwx → sk_test_abcdefghijklmnopqrstuvwx
Use rk_live_ABCDEFGHIJKLMNOPQRSTUVWX for the webhook. → rk_live_ABCDEFGHIJKLMNOPQRSTUVWX

Must be left alone

pk_live_abcdefghijklmnopqrstuvwx
sk_prod_abcdefghijklmnopqrstuvwx

Tags: international, secrets, software-dev, ecommerce

Download the detector as TOML