Skip to content

Update Stripe API key rule in Secret Detection

We have received some info from Stripe about their API key scheme as part of their interest in &4944.

In email, I asked:

It looks like the current pattern we are using (configured here) is: (?i)(sk|pk)(test|live)[0-9a-z]{10,32}

The Security Engineer on their side replied:

A few minor tweaks! We only care about live API keys, as test keys cannot take any live actions against the API, and we would want to replace pk with rk. pk keys are intended to be published, but rk keys are restricted. We also support longer key lengths. So something like:

(?i)(sk|rk)_live_[0-9a-z]{10,128}

Let's evaluate this and update as needed.