Stripe webhook-signing-secret pattern appears in public content
ShipReady found a non-placeholder string matching its supported Stripe webhook-signing-secret pattern in scanned page or script content.
Why it matters
A real webhook signing secret should be held in server-side configuration, not a public client asset.
How ShipReady detects it
What it inspects
ShipReady scans fetched page content and discovered script content for the supported Stripe whsec_ webhook-signing-secret format and applies its placeholder guard.
What triggers a finding
The rule triggers when a non-placeholder string matches the supported whsec_ pattern.
What the evidence shows
The scanner observed a string matching its Stripe webhook-signing-secret format and records only a redacted prefix.
Limits of this check
ShipReady does not contact Stripe, validate the value, inspect a webhook endpoint, or submit a signed event. The format match does not prove that the secret is active, that a server uses it, or that any webhook event can be forged.
How to fix it
Trace the matched value
Find the source or build configuration that introduced the string into public content.
Keep confirmed signing secrets server-side
Remove real webhook signing secrets from browser bundles and store them only in trusted server-side secret configuration.
Review a confirmed secret
If investigation confirms a real signing secret, replace it through the account owner's Stripe webhook configuration.
How to verify the change
Inspect deployed public output
Search deployed HTML and JavaScript after the update.
Expected: No unintended string matching the supported Stripe webhook-secret pattern remains in public content.