Hardcoded API keys in source

Code reviewSecurityMid–Senior~20 min

Review this Go service initializer.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 20 min

Mark a line and say what kind of problem it is.0 findings

1const (

2 stripeSecretKey = "sk_live_51Hcd...REDACTEDxYz"

3 jwtSigningKey = "s3cr3t-signing-key"

6func NewServer() *Server {

7 sc := stripe.NewClient(stripeSecretKey)

8 return &Server{

9 stripe: sc,

10 signJWT: func(claims Claims) string {

11 return jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(jwtSigningKey))

12 },

13 }

14}

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.