Payment test-mode marker appears in client code
ShipReady found a supported payment-provider test or sandbox marker in executable or checkout-referenced client content.
Why it matters
A test marker on a production checkout can cause a payment integration to behave differently from the intended live workflow.
How ShipReady detects it
What it inspects
ShipReady reads executable page regions, fetched scripts, and checkout-referenced content for supported provider test markers and test publishable-key prefixes. It excludes ordinary documentation prose and inert templates.
What triggers a finding
The rule triggers when a supported provider test marker is found in the scanner's executable or referenced-content scope.
What the evidence shows
A supported test or sandbox marker is published in client content that the scanner treats as live integration context.
Limits of this check
ShipReady does not complete a checkout, inspect runtime environment selection, or verify which key is used on every execution path. It cannot establish whether a payment was accepted, charged, or settled, and a staging or preview deployment may use test markers intentionally.
How to fix it
Select the intended provider environment per deployment
Review build-time and runtime payment configuration so production receives the intended live configuration and preview environments use separated test configuration.
Keep secret keys off the client
Use only provider-approved public client identifiers in browser code and keep secret credentials on the server.
How to verify the change
Verify a controlled production-like transaction
Use the provider dashboard and a safe test workflow to confirm the deployment selects the intended account and environment.
Expected: The intended deployment uses the expected provider environment and account.