galakurpi/stripe-prelaunch-security-checklist

This is a security checklist for developers about to accept real payments through Stripe for the first time. It is organized as a practical, self-auditable guide covering the most common and most expensive mistakes that indie developers and small teams make when launching payment processing. The focus is on errors that cause direct financial damage: trusting the browser for the amount charged, skipping webhook signature verification, double-charging due to duplicate event delivery, and accidentally exposing secret API keys. The repository includes a small Python scanner that greps your codebase for the most dangerous of these patterns: a price amount coming from the client, a webhook handler without signature verification, or a secret key that ended up in client-side code. It runs without any installation or API key, and works entirely on your local files. You point it at your project folder, and it reports critical issues with the file and line number. The exit code is non-zero when critical issues are found, so it can be added to a CI pipeline as a pre-launch gate. The written checklist is organized into ten sections: not trusting client-supplied amounts, verifying webhook signatures correctly, making payment writes idempotent so duplicate events do not cause duplicate charges, keeping secret keys server-side, authenticating and authorizing payment endpoints properly, handling the full payment lifecycle including failures, managing subscriptions and entitlements, handling refunds and disputes, protecting personally identifiable information in logs, and final production configuration steps. Items marked with a warning symbol are the ones most commonly linked to real financial losses. The checklist assumes a React and Node/Express stack with Stripe Checkout or PaymentIntents and a PostgreSQL or Supabase database. The README notes that the principles apply to any language and any stack. The automated scanner is described honestly as a first-pass heuristic: it catches common greppable mistakes but cannot evaluate your authentication flow, race conditions, or the full set of failure paths. The written checklist covers that broader scope, so both parts are meant to be used together.