Update Stripe API key rule in Secret Detection
We have received some info from Stripe about their API key scheme as part of their interest in &4944.
In email, I asked:
It looks like the current pattern we are using (configured here) is: (?i)(sk|pk)(test|live)[0-9a-z]{10,32}
The Security Engineer on their side replied:
A few minor tweaks! We only care about live API keys, as test keys cannot take any live actions against the API, and we would want to replace
pk
withrk
.pk
keys are intended to be published, butrk
keys are restricted. We also support longer key lengths. So something like:
(?i)(sk|rk)_live_[0-9a-z]{10,128}
Let's evaluate this and update as needed.