redact-secret · Report

Webhook signing secret

Webhook endpoint signing secret, prefixed whsec_.

Stripe
Detectors: stripe-webhook-signing-secret
Run 2026-10-07
Mode published · redact-secret 0.1.0-beta.14

Dossier verdictReady
Dossier evidence levelT1 · Provider-documented
Dossier researched2026-09-27

Same classifyFixture guard as the organization API key covers whsec_ values; stripe-token's pattern does not match them. Measured as the context-gated Beta.8 arrival family stripe-webhook-signing-secret (#211, research #224): Stripe documents the whsec_ prefix only; the body width and alphabet stay provisional (32 alphanumerics is a provider example, not a grammar; Stripe's own scrubber admits + / =). Scored as the arrival family stripe-webhook-signing-secret (#730; docs/decisions/2026-09-24-score-arrival-families-by-finding-type.md): the product types it inside the shared stripe-token detector as stripe_webhook_signing_secret, so its findings carry the arrival id and its status comes from its own contract, profile and ledger rows. stripe-webhook-signing-secret is not a registry detector id.

New pipelineAuthority

Built from the new pipeline

The new pipeline is the authority for credential qualification. These numbers are read from the qualification view derived from the official credential-eval run of the public-evidence-snapshot population. The regression and policy populations keep their own counts on the qualification pages and are not added in here.

Authority: new
Population: public-evidence-snapshot
Engine: credential-eval 0.1.0-alpha.16
Evidence: snapshot-2026.10.06.4
Run: sha256:4bec6e539482…
Recorded: 2026-10-07
Authorised for: @redact-secret/core@0.1.0-beta.14

Maintainer-reviewed (independent review pending)

598 fixtures of the 7,041 in evidence release snapshot-2026.10.06.4 carry this label. They are counted in the numbers on this page.

Passed the project’s own verification (source evidence, automated checks, recorded counter-arguments); not yet independently reviewed.

OpenRedaction default (all patterns): not measured in this run (optional)

The default (all-pattern) profile is slow and noisy for credential evaluation: personal data and resource identifiers dominate its findings, and its last official measurement took 7 minutes of scanner time on a population the credential profile scans in seconds (its methods run takes 40+ minutes), so it is a manual measurement and never blocks other scanners or core verification (#763). Its earlier results stay as history with their run identity; the credential profile is a separate scanner, never spliced with it.

Last measurement: policy-corpus@linux-x64 (configuration sha256:2451ce7bf380), public-evidence-snapshot+methods@linux-x64 (configuration sha256:d47d081ce5fb), public-evidence-snapshot@linux-x64 (configuration sha256:2451ce7bf380), regression-corpus@linux-x64 (configuration sha256:2451ce7bf380) · engine 0.1.0-alpha.5 · recorded 2026-10-05 · retained record, no longer listed by the run registry. It stays labelled with that run identity and is never combined with another profile or another run.

Open the qualification page for this pointer

OpenRedaction credential profile (33 types): not measured in an official run (local exploratory diagnostics only: see ADR)

The credential profile is the comparison profile chosen in docs/decisions/2026-10-06-choose-the-openredaction-credential-bearing-profile-as-the-comparison-scanner.md. It is optional in the official run class because no pinned engine configuration measures it yet: making it required would refuse every official view until the owner approves the one profile-only run. Its own history starts with that run; nothing of the default's is reused for it.

No earlier measurement of it is recorded. Nothing is shown in its place.

Official measurement: pending: requires owner approval (one profile-only run; see the decision).

Open the qualification page for this pointer

Every population and its qualification

Research record

From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.

Review stateDraft, not reviewed
Format revision1 · current
ResearchResearched
Researched2026-09-27

3 events in the review history: 2 observed, 1 reviewed. Latest: observed on 2026-09-27 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.

Format

Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.

What it looks like

Descriptive pattern: ^whsec_[A-Za-z0-9+/]{32,}={0,2}$

Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.

Format facts

Provider documented · provider-source · current · observed 2026-09-24
whsec_ webhook endpoint signing secret: the whsec_ prefix and the per-endpoint configuration context; no body length or alphabet
- docs.stripe.com/webhooksprovider-documentation · last read 2026-09-27 · latest outcome read · supports the whsec_ prefix and the per-endpoint configuration context; no body length or alphabet
Provider documented · field-prefix · current · observed 2026-09-24
prefix: Webhook signing secrets begin with the literal whsec_ (Dashboard, API and CLI; snapshot and thin destinations alike).
- docs.stripe.com/webhooks/signatureprovider-documentation · last read 2026-09-27 · latest outcome read · supports Dashboard and CLI secrets both start with whsec_ but differ.
- docs.stripe.com/webhooksprovider-documentation · last read 2026-09-27 · latest outcome read · supports Dashboard "Reveal secret": a signing secret beginning with whsec_; v2 event destinations return a value that "starts with whsec_".
Provider documented · field-context · current · observed 2026-09-24
context: The secret is configured per webhook endpoint (STRIPE_WEBHOOK_SECRET / endpoint_secret / signing_secret) and passed to the SDK signature verifier. (Context-gated: whsec_ is also issued by Svix/Standard Webhooks (base64, 24–64 bytes), so the prefix alone does not attribute a value to Stripe. Every positive carries a same-line Stripe context; non-Stripe whsec_ values are neither positives nor controls here (#224 left that contract decision open).)
- docs.stripe.com/keysprovider-documentation · last read 2026-10-04 · latest outcome read · supports "Webhook signing secrets aren't API keys—they're per-webhook secrets."
- docs.stripe.com/webhooksprovider-documentation · last read 2026-09-27 · latest outcome read · supports Code samples read the endpoint secret into the constructEvent / construct_event verifier.
Provider documented · field-body-alphabet · current · observed 2026-09-24
body-alphabet: The body may be alphanumeric or base64 with + / and = padding. (Stripe's own code disagrees with itself. Positives are alphanumeric (satisfying every candidate); the contract pattern admits + / = so no fixture asserts silence on them.)
- stripe/stripe-cli @ master: canary/testutil/sanitize.goprovider-sdk-source · last read 2026-09-24 · latest outcome read · supports The same repo's canary sanitizer uses whsec_[a-zA-Z0-9]{10,} (alphanumeric only).
- stripe/stripe-cli @ master: pkg/reporting/scrub.goprovider-sdk-source · last read 2026-09-24 · latest outcome read · supports Stripe CLI error-report scrubber \bwhsec_[a-zA-Z0-9+/]+=* ("base64 alphabet + optional = padding"); conservative scrubbing, not a generator statement.
Provider documented · field-body-length · current · observed 2026-09-24
body-length: The body is at least 32 characters; 32 and 64 are the widths sources show. (Not exhaustive (#224): an example is not a grammar. The 32 floor only keeps short documentation placeholders out of the pattern; no twin mutates width, and no zero-filled 64-character placeholder is authored as a control because it would satisfy the pattern.)
- docs.stripe.com/api/webhook_endpoints/objectprovider-documentation · last read 2026-09-27 · latest outcome read · supports The API reference example secret has a 32-character mixed-case alphanumeric body. "Only returned at creation" via the API.
- stripe/stripe-node @ master: examples/webhook-signing/.env.exampleprovider-documentation · last read 2026-09-24 · latest outcome read · supports Provider-code placeholder whsec_ + 64 zeros.
- github.com/trufflesecurity/trufflehog/pull/4973provider-documentation · last read 2026-09-24 · latest outcome read · supports Unmerged: exact 32 or 64 alphanumeric.
- github.com/trufflesecurity/trufflehog/pull/4920provider-documentation · last read 2026-09-24 · latest outcome read · supports Unmerged: 32–64 of [A-Za-z0-9+/].
Provider documented · field-mode-marker · current · observed 2026-09-24
mode-marker: No live/test marker in the value.
- docs.stripe.com/webhooksprovider-documentation · last read 2026-09-27 · latest outcome read · supports Test and live endpoints have different secrets; the prefix carries no mode segment.
Unresolved · field-checksum · current · observed 2026-09-24
checksum: Whether the body has a checksum or embedded id.
- docs.stripe.com/webhooksprovider-documentation · last read 2026-09-27 · latest outcome read · supports Nothing stated. SDKs HMAC with the whole string as UTF-8 bytes and never decode it (stripe-go/node/python webhook code).
Unresolved · listed-references · current · observed 2026-09-24
The legacy contract lists 5 references without stating which property each supports.
- docs.stripe.com/webhooks/signatureprovider-documentation · last read 2026-09-27 · latest outcome read · supports Listed as a reference by the legacy contract
- docs.stripe.com/keysprovider-documentation · last read 2026-10-04 · latest outcome read · supports Listed as a reference by the legacy contract
- docs.stripe.com/api/webhook_endpoints/objectprovider-documentation · last read 2026-09-27 · latest outcome read · supports Listed as a reference by the legacy contract
- github.com/redact-secret/redact-secret-benchmarks/issues/224issue-or-discussion · last read 2026-09-24 · latest outcome read · supports Listed as a reference by the legacy contract
- stripe/stripe-cli @ master: pkg/reporting/scrub.goprovider-sdk-source · last read 2026-09-24 · latest outcome read · supports Listed as a reference by the legacy contract
Provider documented · dossier-research · current · observed 2026-09-27
Legacy dossier research (verdict ready, tier T1) cited 5 sources; the dossier does not attribute sources to individual properties.
- docs.stripe.com/webhooks/signatureprovider-documentation · last read 2026-09-27 · latest outcome read · supports Cited by the legacy dossier research for this family
- docs.stripe.com/keysprovider-documentation · last read 2026-10-04 · latest outcome read · supports Cited by the legacy dossier research for this family
- docs.stripe.com/webhooksprovider-documentation · last read 2026-09-27 · latest outcome read · supports Cited by the legacy dossier research for this family
- docs.stripe.com/api/webhook_endpoints/objectprovider-documentation · last read 2026-09-27 · latest outcome read · supports Cited by the legacy dossier research for this family
- redact-secret/redact-secret @ 8b6a5fde52ecb4dfce13f09c7a947062d21483c7: docs/audits/evidence/726/README.mdproject-research-note · last read 2026-09-27 · latest outcome read · supports Final research evidence recorded by the legacy dossier
Provider documented · taxonomy-sources · current · observed 2026-09-27
The legacy taxonomy lists 1 source for this family. The taxonomy records no date; the dossier researchedAt is used as the observed-at date.
- docs.stripe.com/webhooksprovider-documentation · last read 2026-09-27 · latest outcome read · supports Listed as a source for this family in the legacy taxonomy

Open questions

No open question is recorded for this revision.

Benchmark dossier notes

From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.

Shape: prefix whsec_ followed by a body of at least 32 Base64-alphabet characters, optional trailing = padding. Stripe documents only the prefix (in the Dashboard and v2 event destination flows, and for CLI secrets, which are "different" from Dashboard ones) and calls signing secrets "not API keys". The API object example shows 32 mixed-case alphanumerics; a CLI docs placeholder has 14; an SDK example uses 64 zeros. Stripe's own CLI scrubber admits +, / and =, while a second regex in the same repository accepts letters and digits only.
Basis: T1 for the prefix and configuration context (provider docs). Body: provider code and example plus scanner rules, contradictory on alphabet. SDKs use the whole string, prefix included, as the HMAC key and never Base64-decode it.
Issuance: not attempted. Sandbox Dashboard or stripe listen --print-secret is free; checklist in benchmarks#224. There is no live or test segment.
Contract in core: detector-families.md (frozen in the #726 record as context-gated for qualification; the #729 implementation detects the prefix bare, as attribution is a benchmark concept).

In this benchmark

Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.

Fixtures: 29
Left readable: 0
Redacted too much: 0
False alarms: 0

29 fixtures: 3 expect a redaction, 15 must stay quiet, 11 record project policy. See every row

redact-secret fixture counts by evidence level
Evidence level	Fixtures	Left readable	Too much	False alarms
T1Provider-documented	1	0	0	0
T2Tool-corroborated	9	0	0	0
T3Project policy	16	0	0	0
T0Pending review	3	0	0	0

Every scanner on the same fixtures

In run order. Counts are what each scanner recorded on this family's fixtures, whichever rules it has; a scanner with no rule for the family has nothing to report on it.

Counts per scanner on this family's fixtures
Scanner	Fixtures	Left readable	False alarms
flare-redactRuntime library · 1.6.1 · Published npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engine1 rule targets it	29	0	0
gitleaksRepository scanner · 8.30.1 · Directory scan · default rulesNo rule maps to it	29	5	1
redact-secretProduct measured here · 0.1.0-beta.14 · Published npm package · default detectors1 detector mapped	29	0	0
trufflehogRepository scanner · 3.97.4 · Filesystem scan · verification disabledNo rule maps to it	29	11	0

Benchmark dossier questions

Things the sources do not settle. They are listed so nobody reads them as settled.

Open caveat: T1 on the whsec_ prefix and Stripe context only; body width and alphabet are not provider-stated, and Svix and Standard Webhooks issue whsec_ secrets too.

Looks like it, but isn't

Values the dossier records as resembling this credential without being one.

Collisions: Svix and Standard Webhooks also use whsec_ (Base64 of 24 to 64 bytes, decoded before use), plus asymmetric siblings whsk_/whpk_. Public or non-secret values nearby: we_ endpoint ids, ed_ event destination ids, evt_ ids, Stripe-Signature digests, pk_ keys.

Scanner rules for this family

Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.

Peer scanner rules that target this family
Scanner	Rule	What the rule matches
flare-redact · rules 1.6.1	`stripe_webhook_secret`	whsec_ + 32-64 characters

No rule maps to this family in gitleaks, openredaction, trufflehog.

Find

Evidence level

Scanners

29 of 29 rows

Fixtures in this family

29 rows, redact-secret's outcome on each. Rows that need a look come first (0), then the rest in corpus order. Choose "Every scanner" to see each scanner's outcome for the same rows.

Fixtures in Webhook signing secret
Fixture	Kind and evidence	redact-secret
`stripe-webhook-signing-secret-actions-env`stripe · documented-format-literal	Project policyT3 · Project policy	Redacted
`stripe-webhook-signing-secret-compose-webhook-secret`stripe · documented-format-literal	Project policyT3 · Project policy	Redacted
`stripe-webhook-signing-secret-dotenv-webhook-secret`stripe · documented-format-literal	Project policyT3 · Project policy	Redacted
`stripe-webhook-signing-secret-endpoint-create-response`stripe · documented-format-literal	Project policyT3 · Project policy	Redacted
`stripe-webhook-signing-secret-event-destination-create-response`stripe · documented-format-literal	Project policyT3 · Project policy	Redacted
`stripe-webhook-signing-secret-export-webhook-secret`stripe · documented-format-literal	Project policyT3 · Project policy	Redacted
`stripe-webhook-signing-secret-node-construct-event-wide`stripe · documented-format-literal	Project policyT3 · Project policy	Redacted
`stripe-webhook-signing-secret-publishable-key-public-id`stripe · public-identifier	Must not flagT2 · Tool-corroborated	Quiet
`stripe-webhook-signing-secret-python-construct-event`stripe · documented-format-literal	Project policyT3 · Project policy	Redacted
`stripe-webhook-signing-secret-rails-credentials-rolling`stripe · documented-format-literal	Project policyT3 · Project policy	Redacted
`stripe-webhook-signing-secret-stripe-listen-ready`stripe · documented-format-literal	Project policyT3 · Project policy	Redacted
`stripe-webhook-signing-secret-webhook-verifier-log`stripe · documented-format-literal	Project policyT3 · Project policy	Redacted
`stripe-token-shape-6-bare`stripe · unsettled-evidence-input	Pending reviewT0 · Pending	Unscored
`stripe-token-shape-6-quoted`stripe · unsettled-evidence-input	Pending reviewT0 · Pending	Unscored
`stripe-token-shape-6-unicode-crlf`stripe · unsettled-evidence-input	Pending reviewT0 · Pending	Unscored
`stripe-webhook-signing-secret-docs-sentence-prose`stripe · prose-mention	Must not flagT3 · Project policy	Quiet
`stripe-webhook-signing-secret-dotenv-webhook-secret-public-prefix-twin`stripe · public-sibling-prefix	Must not flagT1 · Provider-documented · twin	Quiet
`stripe-webhook-signing-secret-ellipsis-placeholder`stripe · documentation-placeholder	Must not flagT3 · Project policy	Quiet
`stripe-webhook-signing-secret-endpoint-create-response-boundary-twin`stripe · boundary-violation	Must not flagT2 · Tool-corroborated · twin	Quiet
`stripe-webhook-signing-secret-endpoint-object-public-id`stripe · public-identifier	Must not flagT2 · Tool-corroborated	Quiet
`stripe-webhook-signing-secret-event-destination-log-public-id`stripe · public-identifier	Must not flagT2 · Tool-corroborated	Quiet
`stripe-webhook-signing-secret-export-webhook-secret-case-twin`stripe · prefix-near-miss	Must not flagT2 · Tool-corroborated · twin	Quiet
`stripe-webhook-signing-secret-fill-in-placeholder`stripe · documentation-placeholder	Must not flagT3 · Project policy	Quiet
`stripe-webhook-signing-secret-masked-placeholder`stripe · documentation-placeholder	Must not flagT3 · Project policy	Quiet
`stripe-webhook-signing-secret-prefix-only-near-miss`stripe · format-near-miss	Must not flagT2 · Tool-corroborated	Quiet
`stripe-webhook-signing-secret-print-secret-substitution-reference`stripe · templated-reference	Must not flagT3 · Project policy	Quiet
`stripe-webhook-signing-secret-python-construct-event-separator-twin`stripe · prefix-near-miss	Must not flagT2 · Tool-corroborated · twin	Quiet
`stripe-webhook-signing-secret-stripe-signature-header-encoded-value`stripe · benign-encoded-value	Must not flagT2 · Tool-corroborated	Quiet
`stripe-webhook-signing-secret-webhook-verifier-log-alphabet-twin`stripe · wrong-alphabet	Must not flagT2 · Tool-corroborated · twin	Quiet

Sources

Researched 2026-09-27.

Documentation and code

docs.stripe.com/webhooks
benchmarks/lib/assessment.ts (classifyFixture variant guard: "Variant support must not be inferred from a related family name.")
docs.stripe.com/webhooks/signature
docs.stripe.com/api/webhook_endpoints/object
docs.stripe.com/keys

Research log

redact-secret/redact-secret#513Research issue
redact-secret/redact-secret-benchmarks#224Research issue
redact-secret/redact-secret-benchmarks#367Research issue
redact-secret/redact-secret-benchmarks#372Research issue
redact-secret/redact-secret#726Research issue
redact-secret/redact-secret#729Research issue
Final evidence, pinned to a commit/redact-secret/redact-secret/blob/8b6a5fde52ecb4dfce13f09c7a947062d21483c7/docs/audits/evidence/726/README.md