Sensitive Data: Stripe API Key Leak in JavaScript Bundle¶

Identifier: js_data_leak_stripe_key

Scanner(s) Support¶

Description¶

Stripe secret or restricted API keys in JavaScript bundles expose payment-processing credentials to every user who loads the page. Stripe states that only publishable keys belong in client-side code; secret keys must remain on the server.

How we test: We statically analyze first-party JavaScript bundles for patterns matching Stripe API keys (sk_/pk_ with live or test prefixes).

References:

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
• CWE-798: Use of Hard-coded Credentials
• Stripe Docs: API keys
• Stripe Docs: Best practices for managing secret API keys

Configuration¶

Example¶

Example configuration:

---
security_tests:
  js_data_leak_stripe_key:
    issues_count_limit: 20
    skip: false

Reference¶

issues_count_limit¶

Type : integer

The maximum number of issues to report. Use 0 to report all issues.

skip¶

Type : boolean

Skip the test if true.