Audience: Security, Backend, Compliance
Outcomes: Least-privilege posture; correct scope
CORS & CSP
CORS: allow only your frontend domains; with credentials, never
*CSP: restrict
scriptSrc,connectSrc,frameSrcto trusted providers (e.g., Stripe); avoid inline scripts
Secrets & IPs
Store in a secrets manager; rotate regularly
Separate test vs prod secrets
IP allowlists help, but signature verification is mandatory
Compliance notes
With Stripe Checkout/Elements, you don’t handle PANs
SCA/3DS occurs in provider UI or via Intents
Keep audit logs of webhook decisions, releases, admin overrides
Evidence bundles & invoice ledgers are exportable for audits
QA checklist
Secrets not logged; payloads with sensitive data redacted
CSP blocks unexpected scripts/frames
Runbook: “Signature verification failed”
Ensure raw body; confirm correct secret; check clock skew; rotate if leaked.