Stripe Security — Securing Your Payment Integration

# pci_compliance.py
# Understanding PCI compliance levels

def pci_scopes():
    scopes = {
        "Stripe Checkout": "No card data touches your server. PCI scope is minimized (SAQ A).",
        "Stripe Elements": "Card data goes directly to Stripe via iframe. SAQ A or SAQ A-EP.",
        "Custom Card Form": "Card data passes through your server. Full SAQ D or annual audit.",
    }
    
    print("PCI Compliance by Integration Method:")
    for method, scope in scopes.items():
        print(f"\n  {method}:")
        print(f"    {scope}")

pci_scopes()

# key_security.py
# API key security best practices

def secure_key_storage():
    practices = [
        "Store secret keys in environment variables or secrets manager",
        "Never hardcode keys in source code",
        "Use different keys for test and live mode",
        "Rotate keys regularly",
        "Use restricted keys with minimal permissions",
        "Monitor key usage in Stripe Dashboard",
        "Revoke compromised keys immediately",
    ]
    
    print("API Key Security Best Practices:")
    for i, practice in enumerate(practices, 1):
        print(f"  {i}. {practice}")

def check_key_exposure():
    code_patterns = {
        "sk_live_": "WARNING: Live secret key detected in code!",
        "sk_test_": "OK: Test key (but should not be hardcoded)",
        "process.env.STRIPE_KEY": "GOOD: Using environment variable",
        "getSecret('stripe')": "GOOD: Using secrets manager",
    }
    
    for pattern, message in code_patterns.items():
        print(f"  {pattern:40s} {message}")

secure_key_storage()
print()
check_key_exposure()

# radar.py
# Stripe Radar fraud prevention

def configure_radar():
    rules = {
        "High-risk countries": "Block transactions from countries with high fraud rates",
        "Card testing protection": "Detect and block rapid small transactions",
        "Velocity checks": "Limit transactions per card or customer in a time window",
        "IP reputation": "Block known fraudulent IP addresses",
        "Email domain validation": "Flag disposable email domains",
    }
    
    print("Stripe Radar Rule Categories:")
    for rule, description in rules.items():
        print(f"  {rule:30s} | {description}")

def radar_fraud_score(transaction):
    score = 50
    if transaction.get("amount", 0) > 100000:
        score += 20
    if transaction.get("country") != transaction.get("ip_country"):
        score += 15
    if transaction.get("email_domain") in ["tempmail.com", "throwaway.com"]:
        score += 10
    
    risk = "high" if score > 70 else "medium" if score > 40 else "low"
    print(f"Fraud score: {score} ({risk} risk)")
    return risk

configure_radar()
print()
radar_fraud_score({"amount": 50000, "country": "US", "ip_country": "NG", "email_domain": "gmail.com"})

import json

def security_scan(config):
    issues = []
    
    if config.get("secret_key", "").startswith("sk_test_"):
        issues.append("INFO: Using test mode keys")
    
    if "sk_live_" in config.get("code_check", ""):
        issues.append("CRITICAL: Live secret key found in source code!")
    
    if not config.get("webhook_verification"):
        issues.append("HIGH: Webhook signature verification not enabled")
    
    if config.get("integration_type") == "custom_form":
        issues.append("HIGH: Custom card form increases PCI scope")
    
    if not config.get("https_only"):
        issues.append("HIGH: HTTPS not enforced for API calls")
    
    print("Security Scan Results:")
    for issue in issues:
        print(f"  {issue}")
    
    if not issues:
        print("  No security issues found.")
    
    return issues

security_scan({
    "secret_key": "sk_test_abc123",
    "code_check": "const key = 'sk_live_...'",
    "webhook_verification": False,
    "integration_type": "custom_form",
    "https_only": True
})