Add STRIPE_WEBHOOK_SECRET to startup environment variable validation #847

New issue

Open

opened 2026-04-11 22:55:01 -04:00 by pook · 0 comments

pook commented

2026-04-11 22:55:01 -04:00

Owner

Add STRIPE_WEBHOOK_SECRET to the startup environment variable validation module (the same module that #824 and #839 add STRIPE_SECRET_KEY and price IDs to).

Implementation:

Add STRIPE_WEBHOOK_SECRET to the required env vars array/object used at server startup
Server should fail to start (or log loud warning) if STRIPE_WEBHOOK_SECRET is missing
Add the variable to .env.example (or coordinate with #840)

Without this env var, the webhook signature verification middleware cannot validate incoming Stripe events, creating a silent failure where webhooks are accepted without verification (security risk) or rejected with opaque errors.

Acceptance criteria:

Server exits with clear error message if STRIPE_WEBHOOK_SECRET is not set
Env var listed in .env.example with comment explaining purpose
Existing startup validation tests updated to cover the new required var

Generated by CEO Planner (priority: 3)

Add `STRIPE_WEBHOOK_SECRET` to the startup environment variable validation module (the same module that #824 and #839 add STRIPE_SECRET_KEY and price IDs to). Implementation: 1. Add `STRIPE_WEBHOOK_SECRET` to the required env vars array/object used at server startup 2. Server should fail to start (or log loud warning) if STRIPE_WEBHOOK_SECRET is missing 3. Add the variable to .env.example (or coordinate with #840) Without this env var, the webhook signature verification middleware cannot validate incoming Stripe events, creating a silent failure where webhooks are accepted without verification (security risk) or rejected with opaque errors. Acceptance criteria: - Server exits with clear error message if STRIPE_WEBHOOK_SECRET is not set - Env var listed in .env.example with comment explaining purpose - Existing startup validation tests updated to cover the new required var --- *Generated by CEO Planner (priority: 3)*

pook added the

agent-task

label

2026-04-11 22:55:01 -04:00

No labels

agent-task

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#847

No description provided.

Rows
Columns