Skip to content

🔒 Security Fix: Remove Hardcoded Stripe Secrets from Configuration #40

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AnyTng wants to merge 1 commit into
base: main
Choose a base branch
from
Open

🔒 Security Fix: Remove Hardcoded Stripe Secrets from Configuration #40

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions backend/RESTful API/appsettings.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,8 @@
},

"Stripe": {
"SecretKey": "sk_test_51QuyIFD6nzE4vVF4SOS4AQwYaiC4SWV7eJczPpvJCvSFKZ4MYRwLEwtyW5D4wuA89UZFPWTvQQuHRKPuf1wyz3a100UPaEcGhY",
"WebhookSecret": "whsec_80107d4e619ab717a3bf321647ea277de0e7791018c6f95a6fa5af75e57716c5"
"SecretKey": "",
"WebhookSecret": ""
Comment on lines 23 to +25

Copilot AI Apr 6, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR description says the app will fall back to user secrets for local development, but this project doesn't appear to be configured for user-secrets loading (no UserSecretsId in the .csproj and no explicit AddUserSecrets in Program.cs). Either update the PR description to mention only environment variables, or add/enable user-secrets support so the stated fallback actually works.

Copilot uses AI. Check for mistakes.
Comment on lines +24 to +25

Copilot AI Apr 6, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Setting Stripe secrets to empty strings means the configuration keys are still present and will resolve to "" when environment variables aren't set, which can lead to harder-to-diagnose runtime failures in Stripe initialization/webhook validation. Prefer removing these keys entirely (or using null) so missing configuration is more explicit, and ensure deployment docs/env var requirements cover the needed Stripe settings.

Suggested change
"SecretKey": "",
"WebhookSecret": ""
"SecretKey": null,
"WebhookSecret": null

Copilot uses AI. Check for mistakes.
},

"EmailSettings": {
Expand Down