Stripe test and live publishable-key markers ship together
ShipReady found both Stripe test and live publishable-key prefixes in the observed client bundle.
Why it matters
A deployment with multiple environment configurations can be harder to reason about and may select a configuration unexpectedly at runtime.
How ShipReady detects it
What it inspects
ShipReady reads executable page regions and fetched scripts for Stripe publishable-key prefixes and payment integration markers.
What triggers a finding
The rule triggers when a Stripe test marker and a Stripe live publishable-key marker are both present in the same observed client content.
What the evidence shows
The scanned client content includes both supported Stripe test and live publishable-key prefixes.
Limits of this check
ShipReady does not execute the application or inspect feature flags, environment variables, host routing, or provider configuration. It cannot determine which key a visitor uses or whether either value is valid.
How to fix it
Separate deployment configuration
Build each deployment with only its intended public payment configuration and remove unused environment values from browser assets.
Review key-selection logic
Make environment selection explicit and test it for production, previews, and local development.
How to verify the change
Check deployed client assets
Inspect the production bundle and configuration path for both prefixes after a release.
Expected: Each deployment exposes only the public key intended for that environment.