Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

This Stripe API Key is hardcoded. For better security, consider using a .env file. See https://stripe.com/docs/keys#safe-keys for more advice. #222

Closed
dani3l3 opened this issue May 6, 2021 · 1 comment
Closed

This Stripe API Key is hardcoded. For better security, consider using a .env file. See https://stripe.com/docs/keys#safe-keys for more advice. #222

dani3l3 opened this issue May 6, 2021 · 1 comment

Comments

@dani3l3
Copy link

dani3l3 commented May 6, 2021 •
edited
Loading

This message/recommendation also triggers for my actual .env file, the key is NOT in the code.
I guess those .env files should be excluded from the scan if the recommendation is to use them... it sounds rather stupid to be scolded because you should be doing something.... that you are actually already doing.
I am using this popular library to handle the .env configuration https://github.com/vlucas/phpdotenv
gracegoo-stripe added a commit that referenced this issue Jun 3, 2021
@gracegoo-stripe
Ignore .env files and redacted keys
7b417cc 
This change only protects against the specific redacted format that Stripe returns which looks something like "sk_live_aa********************1234".
It does not attempt to detect other potential ways users can modify the keys nor actually validate that the key is real.

This change fixes #220 and #222
@gracegoo-stripe gracegoo-stripe mentioned this issue Jun 3, 2021
Merged
gracegoo-stripe added a commit that referenced this issue Jun 3, 2021
@gracegoo-stripe
Ignore .env files and redacted keys (#245)
5680aec 
The redaction change is targeted to protect against the specific redacted format that Stripe returns which looks something like "sk_live_aa********************1234".
It does not attempt to detect other potential ways users can modify the keys nor actually validate that the key is real.

This change fixes #220 and #222
@gracegoo-stripe
Copy link
Contributor

Thanks for reporting the bug @dani3l3! We've added logic to ignore .env files from being flagged by our linter in the PR above.

@amcjen amcjen mentioned this issue Jul 15, 2022
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@dani3l3 @gracegoo-stripe