Combines codebase scan + account settings review.
Codebase scan
Grep for leaked secrets: sk_live, sk_test, rk_live, whsec_, hardcoded keys outside env.
Checklist
| Area | Check |
|---|---|
| Secret keys | Only in env/secrets vault, never client or repo |
| Publishable key | pk_ only on client (safe) |
| Restricted keys | Used for scoped/agent access, least privilege |
| Webhook | whsec_ verified, not skipped |
| PCI scope | Using Checkout/Elements (SAQ-A), not raw card handling |
| Logging | No full card / secret / client_secret in logs |
| Key rotation | Old keys revoked in Dashboard |
Output Template
Security Audit
Critical:
- [leaked/hardcoded key at file:line]
Harden:
- [use restricted key for X]
OK:
- [Checkout keeps PCI scope minimal]
Immediate: [rotate/remove any exposed key]
If a live secret key is found in the repo, advise rotating it immediately in the Dashboard.