FINDINGsecret.
Jump to what to dosecret.test_mode_token
A Stripe test-mode secret key (sk_test_ or rk_test_) appears in the text.
What it looks at#
Stripe secret and restricted keys that carry the explicit test mode marker:
sk_test_... and rk_test_.... Placeholders (sk_test_xxxxxxxx) are skipped. Live keys
(sk_live_) are a secret.provider_token finding,
and publishable keys (pk_live_, pk_test_) emit nothing: they are built to ship in
client code.
Why it matters#
A test-mode key cannot move real money, but it authenticates to the account’s test data and API, and it shows that the same repository or paste may hold the live key next to it.
What to do#
Low severity. Roll the key in the Stripe dashboard if the account’s test data matters, and check what else was pasted alongside it.
Example#
curl -s -X POST https://api.stormdoor.dev/v1/secrets \
-H "Authorization: Bearer sk_live_..." \
-H "content-type: application/json" \
-d '{"text":"STRIPE_SECRET_KEY=sk_test_Zk3pQ8rT1vWx7YbN5cLd2HgJ"}'The response carries one secret.test_mode_token finding.