Nothing to hand? Load the
— a live key in the source, a webhook that trusts its own request body, a decimal
unit_amount, an amount posted by the browser, card fields assembled server-side
and a subscription with no lifecycle events — or the
,
where the correct verdict is production-ready and the useful output is what to add next.
Paste the code — the prescan is free
No upload, no AI: the prescan reads your source in the browser and lists what it mechanically found. The inventory of payment calls, webhook events, routes and client construction, then the flags — secret keys and signing secrets written into the source, a webhook accepted without verifying Stripe-Signature, a JSON body parser that destroys the signature, money-moving calls with no idempotency key, decimal amounts, prices and quantities read from the request, no webhook lane at all, events never de-duplicated by event.id, no requires_action branch, raw card numbers server-side, an unpinned API version, missing error handling, an amount with no currency, and a subscription sold with no renewal or cancellation handling. Each group explains why it matters. Anything key-shaped is masked before it is shown back to you, and the masked form is what travels with the run.
The AI reviews it — this is the metered part
A senior payments engineer's pass: a go-live posture with the single most important change named, the inventory with each construct's role, and prioritized findings across security, correctness, idempotency, webhooks, lifecycle and maintainability — each with the problem, what it costs in money, support load or compliance exposure, the fix and a corrected fragment in your SDK's language. Every prescan flag is confirmed or explicitly set aside. Findings may only cite calls, routes and events that actually appear in your code, and no secret value is ever echoed back. Pricing is honest: a worst-case amount is reserved before the run and only what the run actually uses is charged — the meter next to the button shows both.
Fix, export, ship
A go-live checklist — the blocking findings plus the fixed pre-launch items — for the release ticket, every corrected snippet in one paste-ready block, the findings as GitHub PR review comments with ```suggestion fences you can apply from the review UI, a tickable action checklist, the findings table as CSV, and Markdown or JSON export of the whole review. Then start fixing: the prescan re-runs as you edit and the strip above the run button counts the flags you have cleared, the ones still open and any you have just introduced — in the browser, for free, before you pay for a second review. Reviews are saved to your SkillSafe account when you are signed in, so they follow you to another machine; restore puts the code back in the form too.
Derived from the @wshobson/stripe-integration skill (MIT license). Not affiliated with or endorsed by Stripe, Inc.