Will It Vibe?Stripe webhook signing secret
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
A Stripe webhook signing secret (whsec_...) was found. Leaking it lets an attacker forge webhook events that your server will accept as genuine.
Why it matters
A Stripe webhook signing secret lets your server verify that webhook events really came from Stripe. If it leaks, an attacker can forge events (like a payment succeeding) that your server will accept as genuine. That can unlock paid features or fulfill orders without payment.
How to fix it
Move the signing secret into an environment variable and read it in the webhook handler. Roll the webhook signing secret in the Stripe dashboard endpoint settings. Keep verifying every event signature.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo