69 lines
2.5 KiB
Markdown
69 lines
2.5 KiB
Markdown
# stripe
|
|
|
|
## Purpose
|
|
|
|
Detects Stripe API keys — both secret keys (`sk_live_` / `sk_test_`) and
|
|
publishable keys (`pk_live_` / `pk_test_`) — embedded in arbitrary strings.
|
|
While publishable keys are technically public, detecting them prevents
|
|
environment confusion. Secret keys provide full API access and must never
|
|
appear in logs or source code.
|
|
|
|
## Features
|
|
|
|
- Separate regexes for secret and publishable prefixes to distinguish types.
|
|
- Live secret keys receive a higher confidence score (`0.99`) than test
|
|
variants (`0.9`) because live credentials are more sensitive.
|
|
- Publishable keys score `0.9` regardless of environment.
|
|
- Minimum 24-character suffix requirement filters out truncated or partial
|
|
matches.
|
|
|
|
## Usage: Basic Example
|
|
|
|
```ts
|
|
import { detect } from '@suaveplan/security-codes/patterns/stripe';
|
|
|
|
const matches = detect('STRIPE_SECRET=sk_live_ABCDEFGHIJKLMNOPQRSTUVWX');
|
|
// matches[0].type === 'stripe-secret'
|
|
// matches[0].confidence === 0.99
|
|
```
|
|
|
|
## Usage: Advanced Example
|
|
|
|
```ts
|
|
import { detect } from '@suaveplan/security-codes/patterns/stripe';
|
|
|
|
const env = 'sk_test_TESTKEY1234567890123456 pk_live_PUBKEY1234567890123456';
|
|
const matches = detect(env);
|
|
// matches[0].type === 'stripe-secret', confidence 0.9 (test key)
|
|
// matches[1].type === 'stripe-publishable', confidence 0.9
|
|
```
|
|
|
|
## API Reference
|
|
|
|
### `detect(input: string): SecurityCodeMatch[]`
|
|
|
|
Scans `input` for Stripe secret and publishable keys.
|
|
|
|
| Parameter | Type | Description |
|
|
|---|---|---|
|
|
| `input` | `string` | The string to scan |
|
|
|
|
Returns an array of `SecurityCodeMatch` objects. Live secret keys have
|
|
`confidence: 0.99`, all other variants have `confidence: 0.9`.
|
|
|
|
## Implementation Notes
|
|
|
|
Stripe's key format is documented in their API reference. The `\b` word
|
|
boundary on both ends prevents matching a key that is part of a longer
|
|
alphanumeric string. Both regex objects have `lastIndex` reset before each
|
|
scan to handle repeated calls safely.
|
|
|
|
Distinguishing live from test keys matters because test keys can be committed
|
|
to public repositories intentionally (for CI integration tests), while live
|
|
keys must never appear outside of secrets management infrastructure. The
|
|
confidence delta between `sk_live_` (`0.99`) and `sk_test_` (`0.9`) allows
|
|
callers to apply a stricter response policy to live keys — for example,
|
|
immediately revoking them via Stripe's API — while treating test-key
|
|
detections as lower-priority warnings. Publishable keys are tracked at `0.9`
|
|
to surface environment-confusion issues during code review.
|