stripe

Purpose

Detects Stripe API keys — both secret keys (sk_live_ / sk_test_) and publishable keys (pk_live_ / pk_test_) — embedded in arbitrary strings. While publishable keys are technically public, detecting them prevents environment confusion. Secret keys provide full API access and must never appear in logs or source code.

Features

Separate regexes for secret and publishable prefixes to distinguish types.
Live secret keys receive a higher confidence score (0.99) than test variants (0.9) because live credentials are more sensitive.
Publishable keys score 0.9 regardless of environment.
Minimum 24-character suffix requirement filters out truncated or partial matches.

Usage: Basic Example

import { detect } from '@suaveplan/security-codes/patterns/stripe';

const matches = detect('STRIPE_SECRET=sk_live_ABCDEFGHIJKLMNOPQRSTUVWX');
// matches[0].type === 'stripe-secret'
// matches[0].confidence === 0.99

Usage: Advanced Example

import { detect } from '@suaveplan/security-codes/patterns/stripe';

const env = 'sk_test_TESTKEY1234567890123456 pk_live_PUBKEY1234567890123456';
const matches = detect(env);
// matches[0].type === 'stripe-secret', confidence 0.9 (test key)
// matches[1].type === 'stripe-publishable', confidence 0.9

API Reference

`detect(input: string): SecurityCodeMatch[]`

Scans input for Stripe secret and publishable keys.

Parameter	Type	Description
`input`	`string`	The string to scan

Returns an array of SecurityCodeMatch objects. Live secret keys have confidence: 0.99, all other variants have confidence: 0.9.

Implementation Notes

Stripe's key format is documented in their API reference. The \b word boundary on both ends prevents matching a key that is part of a longer alphanumeric string. Both regex objects have lastIndex reset before each scan to handle repeated calls safely.

Distinguishing live from test keys matters because test keys can be committed to public repositories intentionally (for CI integration tests), while live keys must never appear outside of secrets management infrastructure. The confidence delta between sk_live_ (0.99) and sk_test_ (0.9) allows callers to apply a stricter response policy to live keys — for example, immediately revoking them via Stripe's API — while treating test-key detections as lower-priority warnings. Publishable keys are tracked at 0.9 to surface environment-confusion issues during code review.

2.5 KiB Raw Permalink Blame History