# Stripe pre-launch checklist

From BuildThenTested (https://buildthentested.com/stack/stripe/). 12 checks in the order we run them, most severe first. Each check links to a page with what it looks like, a self-check and a fix direction.

Defaults referenced are from Stripe's documentation, verified 2026-09-21. Tick a box only after you have seen the result yourself.

## Secrets and keys

- [ ] **NEXT_PUBLIC_ prefix on a secret** (critical). In your hosting dashboard (Vercel: Project, Settings, Environment Variables) or your .env files, list every variable whose name starts with NEXT_PUBLIC_.
  https://buildthentested.com/patterns/next-public-env-var-exposes-secret/

- [ ] **Secrets committed to the code repository** (critical). Open your project on GitHub (or the code view in your builder) and look at the file list for .env, .env.local, .env.production, serviceAccountKey.json or firebase-adminsdk files.
  https://buildthentested.com/patterns/secrets-committed-to-repo/

## Payments

- [ ] **Stripe webhook accepted without signature verification** (critical). In the Stripe Dashboard, open Developers, then Webhooks, and copy the endpoint URL your app uses. It usually ends in something like /api/stripe/webhook or /functions/v1/stripe-webhook.
  https://buildthentested.com/patterns/stripe-webhook-without-signature-verification/

## Deploy and config

- [ ] **AI agent with production credentials** (critical). Open the folder the agent works in and look for .env, .env.local or similar files; note whether any value starts with sk_live_, contains the word prod, or is a service-role or admin key.
  https://buildthentested.com/patterns/ai-agent-with-production-credentials/

## Mobile

- [ ] **Secrets in the mobile app bundle** (critical). Open the project's .env files and app.json or app.config.js; list every variable whose name starts with EXPO_PUBLIC_ or that sits under extra.
  https://buildthentested.com/patterns/secrets-in-mobile-app-bundle/

## Secrets and keys

- [ ] **Third-party API key in the JavaScript bundle** (high). Open your live app in Chrome, right-click, choose Inspect, then open the Sources tab.
  https://buildthentested.com/patterns/api-key-in-javascript-bundle/

- [ ] **Secrets and internals in error messages and logs** (high). Open your live app, right-click, choose Inspect, then the Network tab. Trigger an error on purpose: submit a form with a field left blank, or visit an address like /api/anything-made-up.
  https://buildthentested.com/patterns/secrets-in-error-messages-and-logs/

## Payments

- [ ] **No idempotency on payment handlers** (high). In the Stripe Dashboard, open Developers, then Webhooks, select your endpoint and open a recent invoice.paid or checkout.session.completed event for a test account.
  https://buildthentested.com/patterns/no-idempotency-on-payment-handlers/

- [ ] **Price or plan taken from the client** (high). Open your app's pricing page in Chrome, press F12 to open developer tools (the browser's built-in inspector), and select the Network tab.
  https://buildthentested.com/patterns/price-or-plan-taken-from-client/

- [ ] **Subscription state trusted from local storage** (high). Sign in to your app with a free account, press F12 to open developer tools, select the Application tab, then Local Storage on the left.
  https://buildthentested.com/patterns/subscription-state-trusted-from-local-storage/

- [ ] **Stripe test keys in production** (high). Open your live app's checkout, press F12, select the Network tab, and start a checkout. Look for requests to stripe.com or js.stripe.com and read their URLs and payloads for a key beginning pk_test_ or a session ID beginning cs_test_.
  https://buildthentested.com/patterns/test-keys-in-production/

## Reliability

- [ ] **Retries with no pause and no cap** (medium). Open your app in Chrome, press F12 and choose the Network tab.
  https://buildthentested.com/patterns/retries-without-backoff/

---

We test against a defined checklist and report what we find. We do not guarantee that an app is free of vulnerabilities. We are not a certified penetration-testing firm and do not issue compliance attestations. We do not rebuild your app; fixes are yours or your developer's, and we re-check them.

Questions: hello@buildthentested.com