Gateway secrets out of the repository

gateway-secrets-out-of-repoDeterministic

Payment gateway secret keys are read from the environment or a secret store, never committed.

v1.0.2 · current

Version 1.0.2

Implementation sha256 Published CWE-798

Verifies: No payment gateway secret (secret key, restricted key, webhook signing secret, API key, access token, client secret, merchant key) is committed in code, configuration or env files.
Inputs: Every text file of the checkout up to 2 MB, tests and fixtures included; vendored and build folders excluded. Paths listed in excludes (test, spec and tmp files, __tests__, __mocks__, fixtures, test, tests and audit-scripts folders) are never analysed.
Decision rule: Not applicable when no gateway is referenced. FAIL when a real-looking gateway secret is found: Stripe sk_live/rk_live/whsec_ (HIGH), sk_test/rk_test (MEDIUM, blocks in Extended suites), Mollie, Square, Adyen, Paddle, Checkout.com and Razorpay key formats, a `<gateway>…secret/private key/api key = '<literal>'` assignment, an SDK initialised with a literal, or a committed .env (not .example/.sample/.template) setting a gateway secret variable (all HIGH). Placeholders and publishable keys are ignored; a real-looking value in an example env file is LOW. PASS when a gateway is referenced and no secret is committed. A fixture-looking value (sk_test_, example, dummy) in real code is LOW, informative.
Type: deterministic

1.0.2: never analyses temporary files (*.tmp.*; spec.excludes follows AUDITOR_ANALYSIS_EXCLUDES). (1.0.1: never analyses test, spec, fixture and mock paths nor the auditor's own scripts (spec.excludes = AUDITOR_ANALYSIS_EXCLUDES); a fixture-looking secret (sk_test_, example, dummy) in real code is LOW, informative; every model call stays under the engine prompt cap (spec.promptMaxChars = AUDITOR_AI_PROMPT_MAX_CHARS): assess mode sends the candidate set in parts and aggregates the verdicts (a HIGH in any part is a FAIL, an unsatisfied part is a FAIL).)

{ id: 'stripe-secret-live', re: /\b(?:sk|rk)_live_[0-9A-Za-z]{20,}\b/g, severity: 'high' },

{ id: 'stripe-webhook-secret', re: /\bwhsec_[0-9A-Za-z]{20,}\b/g, severity: 'high' },

{ id: 'gateway-secret-assignment', re: /\b(?:stripe|paypal|braintree|adyen|...)[\w.-]{0,40}?(?:secret|private[_-]?key|api[_-]?key|...)\w*\s*(?::|=|=>)\s*['"]([A-Za-z0-9+/=_.-]{16,})['"]/gi },

// placeholders (x, *, your, changeme, example) and pk_ publishable keys never count; committed .env with a gateway secret -> FAIL

The full script is disclosed on request in a read-only viewer (never published on GitHub); the attestation binds to this exact hash.