[sh1pt-actions-fleet]

Remove STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET from the SaaSRow dev2 function secret map so future function syncs do not restore the legacy Stripe credentials. The production app already uses CoinPay with PayPal support, and the live Stripe webhook endpoint has been disabled. This keeps the payment feature and archived source intact while leaving Stripe credentials out of the active function deployment configuration.

Validation: the JSON parses; the live functions secrets file contains CoinPay keys and no Stripe keys.

[github-actions]

ThreatCrush Security Scan

41 finding(s)

HIGH/CRITICAL: 15 | MEDIUM: 12 | LOW: 14

Severity	Rule	Location
HIGH	py-ssrf-outbound-request	dev2/dev2-site:151
HIGH	py-ssrf-outbound-request	dev2/dev2-site:1062
HIGH	py-ssrf-outbound-request	dev2/dev2-site:1799
HIGH	sh-remote-script-execution	root-ubuntu.sh:3262
HIGH	sh-remote-script-execution	root-ubuntu.sh:3263
HIGH	sh-remote-script-execution	root-ubuntu.sh:5168
HIGH	sh-remote-script-execution	root-ubuntu.sh:5172
HIGH	sh-remote-script-execution	root-w3bs-os.sh:3639
HIGH	sh-remote-script-execution	root-w3bs-os.sh:3640
HIGH	sh-remote-script-execution	root-w3bs-os.sh:5569
HIGH	sh-remote-script-execution	root-w3bs-os.sh:5579
HIGH	sh-remote-script-execution	root-w3bs-os.sh:5586
HIGH	sh-remote-script-execution	root-w3bs-os.sh:5602
HIGH	sh-remote-script-execution	root-w3bs-os.sh:5607
HIGH	sh-plaintext-download	root-w3bs-os.sh:6289
MEDIUM	sql-template-interpolation	dev2/dev2-site:1289
MEDIUM	sql-template-interpolation	dev2/dev2-site:1366
MEDIUM	sh-remote-script-execution	root-ubuntu.sh:5376
MEDIUM	redos-nested-quantifier	src/domain-free.ts:56
MEDIUM	redos-nested-quantifier	src/emoji.ts:167
MEDIUM	redos-nested-quantifier	src/icon.ts:166
MEDIUM	redos-nested-quantifier	src/mail.ts:1060
MEDIUM	sql-template-interpolation	src/users-dump.ts:487
MEDIUM	sql-string-concatenation	src/users-dump.ts:507
MEDIUM	sql-template-interpolation	src/users-dump.ts:540
MEDIUM	sql-string-concatenation	src/users-dump.ts:574
MEDIUM	redos-nested-quantifier	src/wcag.ts:556
LOW	secret-generic-credential	src/credentials.ts:41
LOW	secret-generic-credential	src/credentials.ts:58
LOW	secret-generic-credential	src/credentials.ts:61
LOW	secret-generic-credential	src/credentials.ts:66
LOW	secret-generic-credential	src/user-export.ts:689
LOW	secret-generic-credential	src/user-export.ts:695
LOW	secret-generic-api-key	test/credentials.test.ts:208
LOW	secret-generic-credential	test/mail.test.ts:141
LOW	secret-generic-credential	test/proxy.test.ts:69
LOW	secret-generic-credential	test/proxy.test.ts:85
LOW	secret-generic-credential	test/shorten.test.ts:36
LOW	secret-database-url	test/users-dump.test.ts:108
LOW	secret-database-url	test/users-dump.test.ts:119
LOW	secret-database-url	test/users-dump.test.ts:120

Snippets are redacted; ThreatCrush never prints matched credential material.