Skip to content
BuildThenTestedSee packages

Stripe pre-launch checklist

12 checks in the order we run them, most severe first. Each one has a self-check you can do in the Stripe console and your browser, and a fix direction. Free to use; nothing to sign up for.
Download .md

Defaults referenced come from Stripe's documentation, verified 2026-09-21, on the Stripe hub.

  1. Secrets and keys

  2. Payments

    • Stripe webhook accepted without signature verification

      In the Stripe Dashboard, open Developers, then Webhooks, and copy the endpoint URL your app uses. It usually ends in something like /api/stripe/webhook or /functions/v1/stripe-webhook.

      Critical
    • No idempotency on payment handlers

      In the Stripe Dashboard, open Developers, then Webhooks, select your endpoint and open a recent invoice.paid or checkout.session.completed event for a test account.

      High
    • Price or plan taken from the client

      Open your app's pricing page in Chrome, press F12 to open developer tools (the browser's built-in inspector), and select the Network tab.

      High
    • Subscription state trusted from local storage

      Sign in to your app with a free account, press F12 to open developer tools, select the Application tab, then Local Storage on the left.

      High
    • Stripe test keys in production

      Open your live app's checkout, press F12, select the Network tab, and start a checkout. Look for requests to stripe.com or js.stripe.com and read their URLs and payloads for a key beginning pk_test_ or a session ID beginning cs_test_.

      High

  3. Deploy and config

    • AI agent with production credentials

      Open the folder the agent works in and look for .env, .env.local or similar files; note whether any value starts with sk_live_, contains the word prod, or is a service-role or admin key.

      Critical

  4. Mobile

    • Secrets in the mobile app bundle

      Open the project's .env files and app.json or app.config.js; list every variable whose name starts with EXPO_PUBLIC_ or that sits under extra.

      Critical

  5. Reliability

Questions

stripe security checklist

The list above: 12 checks across 5 categories, most severe first. Each links to a page with what the issue looks like, a self-check and a fix direction. Download the Markdown file to tick items off in your own notes.

can i use this checklist without buying anything

Yes. That is the point of publishing it. If you run every self-check and fix what you find, you have done most of what the security sweep does. What our test adds is a second account, scripts that enumerate everything, and a written report you can show someone.

Prefer someone else to run it: the security sweep covers the critical items in 24 hours; the pre-launch check covers the full list. Or run the self-check tool.