Stripe restricted-key pattern appears in public content
ShipReady found a non-placeholder string matching its supported live Stripe restricted-key pattern in scanned page or script content.
Why it matters
A real restricted key belongs in server-side configuration rather than an asset that every browser visitor can inspect.
How ShipReady detects it
What it inspects
ShipReady scans fetched page content and discovered script content for the supported rk_live_ Stripe restricted-key pattern and applies its placeholder guard.
What triggers a finding
The rule triggers when a non-placeholder string matches the supported live restricted-key pattern.
What the evidence shows
The scanner observed a string matching its Stripe restricted-key format and reports only a redacted prefix.
Limits of this check
ShipReady does not authenticate to Stripe, validate the value, inspect the key's restrictions, or make an API call. The static match does not prove that the key is active or which account actions, if any, it permits.
How to fix it
Identify the source
Locate the source or build input that included the value in public output.
Remove confirmed restricted keys from browser assets
Keep real restricted keys in server-only secret management and prevent build tooling from inlining them into client code.
Review confirmed restrictions
If the value is confirmed as real, review and replace it through the account owner's Stripe controls.
How to verify the change
Inspect deployed assets
Search the deployed HTML and JavaScript after release.
Expected: No unintended rk_live_ pattern remains in public content.