Shrike CLI | Stripe Financial Risk Scanner

shrike audit ./src_backend

➜ shrike audit ./src_backend

╭────────────────────────── SHRIKE REPO AUDIT START ───────────────────────────╮
│ ✓ Traversed 412 files. Ignored 300. Isolated 12 Stripe files in 0.04s. │
╰──────────────────────────────────────────────────────────────────────────────╯

╭────────────────────────── FINANCIAL THREAT MATRIX ───────────────────────────╮
│ CRITICAL RISKS (2) │
│ 1. HARDCODED_LIVE_KEY │
│ 2. MISSING_IDEMPOTENCY_KEY │
╰──────────────────────────────────────────────────────────────────────────────╯

────────────────────────────────────────────
[CRITICAL] HARDCODED_LIVE_KEY

Location:
- src/app/api/webhook/route.ts:4

Financial Impact:
Live Stripe secret exposed in source code. Immediate account compromise risk.

Patch Goal:
Move secret to environment variable and rotate immediately.
────────────────────────────────────────────

Generic linters complain about semicolons.
Shrike audits for revenue leaks.

Stripe bugs don't crash your app. They silently double charge customers, fail renewals, break webhook validation, and leak live API keys. Shrike catches these risks before production.

100% Local Privacy

Idempotency Failures

Detects missing transaction guards on PaymentIntent.create that lead to double-charging customers during network timeouts.

Webhook Bypasses

Flags missing constructEvent validations that allow attackers to forge payloads and grant themselves free premium access.

Framework Blindspots & State Traps

Natively detects the Next.js App Router req.json() stream consumption trap that permanently breaks signatures. Flags unhandled 3D Secure (requires_action) states that cause EU checkout flows to silently bleed revenue.

- req.json()
+ req.text()

Three Modes. Zero Cloud.

shrike audit

Repo Scanning

Scans massive codebases in milliseconds. Bypasses node_modules natively. Outputs a ranked CFO-level financial risk matrix.

shrike analyze

Forensic Parsing

Diagnoses complex Stripe state-machine failures from raw server stack traces. Unpacks payloads to find the exact config error.

shrike watch

Live Monitoring

Tails your webhook logs securely during development. Throws red terminal alerts the second a vulnerability is triggered.

EARLY ACCESS

Enterprise Audit License

Use Shrike on unlimited personal and commercial projects.

$149 / one-time

All 3 CLI commands (Audit, Analyze, Watch)

100% Local File Operation

Includes Free updates for 6 months

Commercial usage allowed

Purchase License Key

Instantly delivered: shrike activate YOUR_KEY

Generic linters complain about semicolons. Shrike audits for revenue leaks.