lovable + stripe

Lovable + Stripe pre-launch checklist: payments without leaking

When you wire Stripe into a Lovable app, the publishable key belongs in the browser and the secret key belongs in a server function — and Lovable does not always know the difference. Confirm each of these before your first paying user.

12 checks

Tick through each one

Click any item to open the detailed fix guide. The detector tag shows which scanner module flips the state pass or fail when you run a SafeToShip scan.

Paste this into Lovable

One prompt that runs the entire checklist as a code review pass.

Audit my Lovable + Stripe integration: confirm the sk_live_ key is server-only and never NEXT_PUBLIC_, confirm pk_live_ is used in the client, verify the webhook handler uses stripe.webhooks.constructEvent with the signing secret, switch from master secret keys to per-integration restricted keys, lock CSP to allow only js.stripe.com for inline scripts, enable HSTS, ensure orders/subscriptions tables in Supabase have RLS scoped to the customer, allowlist specific origins on /api/checkout CORS, add Secure+HttpOnly+SameSite=Lax on session cookies, add rate limiting on /api/checkout, and confirm no mixed content on the checkout page.

FAQ

Frequently asked questions

Do I need PCI compliance for a Lovable app using Stripe Checkout?
Stripe Checkout (the hosted page) keeps you at SAQ-A — minimal PCI scope. You still need TLS, secure cookies, and proper webhook handling. SafeToShip checks the technical baseline but does not certify PCI compliance.
What if the webhook handler skips signature verification?
Anyone can post fake events to your webhook endpoint and trigger fulfillment, refunds, or balance updates. Always verify with stripe.webhooks.constructEvent. If you skipped it, fix it before processing another payment.

Per-issue depth

Fix guides for this checklist

Exposed Stripe secret key

A leaked Stripe secret key means an attacker can charge your customers, refund payments, or drain your account. Rotate immediately.

Read more

Hardcoded API key in JS

Any secret in your client bundle is public. Here is how to find them, rotate them, and move the calls server-side.

Read more

Missing CSP header

A missing Content-Security-Policy header lets attackers inject scripts into your site. Here is what CSP does, why you need it, and how to add it in Next.js, Vercel, and Supabase apps.

Read more

CORS allows all origins

An Access-Control-Allow-Origin: * policy lets any site call your API. Sometimes that is fine, often it is a mistake. Here is how to decide and fix it.

Read more

Run the scan to confirm each check

60 seconds. Free. No account required.