Code reviewMediumcr-g033

Subject Hardcoded secretsLevel Mid–Senior~20 minCommon in Security interviewsIndustries Software development

Question

Review this Go service initializer.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewgo

1const (2    stripeSecretKey = "sk_live_51Hcd...REDACTEDxYz"3    jwtSigningKey   = "s3cr3t-signing-key"4)5 6func NewServer() *Server {7    sc := stripe.NewClient(stripeSecretKey)8    return &Server{9        stripe: sc,10        signJWT: func(claims Claims) string {11            return jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(jwtSigningKey))12        },13    }14}

Run or narrate your approach, then ask the coach.