{
  "schemaVersion": 1,
  "methodology": "https://ionbin.com/interfaces/methodology/#evaluations",
  "evaluation": {
    "id": "stripe-cli",
    "testedOn": "2026-10-18",
    "coverage": "local-runtime",
    "summary": "Account-free dry runs serialized GET and POST requests and accepted the live-mode flag. No request was submitted to Stripe and no payment, customer or webhook was created.",
    "identity": {
      "version": "1.54.0",
      "target": "Official Stripe CLI Windows x64 release archive",
      "integrity": "SHA-256 9653307aa5bf56f1fa8b8c1ca981e42b0be39af5d6ef5e5eb3686061450c7e4b of the official downloaded stripe.zip artifact."
    },
    "environment": [
      "Windows 11 x64; Python 3.12.10 harness. Raw timestamps UTC.",
      "Fresh per-tool home/config/cache; child environment constructed from OS/runtime paths, explicit isolation variables and no inherited credentials. Synthetic fixtures only; no user account sign-in."
    ],
    "checks": [
      {
        "id": "stripe-cli-version",
        "name": "Downloaded version",
        "method": "<evaluation>\\downloads\\cli\\stripe\\stripe.exe --version",
        "expected": "Print the pinned binary version.",
        "observed": "Exit 0. stripe version 1.54.0",
        "outcome": "pass"
      },
      {
        "id": "stripe-cli-dryrun-get-rerun",
        "name": "Preview a customer-list request",
        "method": "<evaluation>\\downloads\\cli\\stripe\\stripe.exe get /v1/customers --limit 2 --dry-run",
        "expected": "Emit GET /v1/customers with limit=2, without sending it.",
        "observed": "Exit 0. {\n  \"dry_run\": {\n    \"method\": \"GET\",\n    \"url\": \"https://api.stripe.com/v1/customers\",\n    \"params\": {\n      \"limit\": \"2\"\n    },\n    \"headers\": {}\n  }\n}",
        "outcome": "pass"
      },
      {
        "id": "stripe-cli-dryrun-post-rerun",
        "name": "Preview a customer-create request",
        "method": "<evaluation>\\downloads\\cli\\stripe\\stripe.exe post /v1/customers --data description=ionbin-synthetic-only --dry-run",
        "expected": "Emit POST /v1/customers with the synthetic description, without sending it.",
        "observed": "Exit 0. {\n  \"dry_run\": {\n    \"method\": \"POST\",\n    \"url\": \"https://api.stripe.com/v1/customers\",\n    \"params\": {\n      \"description\": \"ionbin-synthetic-only\"\n    },\n    \"headers\": {\n      \"Content-Type\": \"application/x-www-form-urlencoded\"\n    }\n  }\n}",
        "outcome": "pass"
      },
      {
        "id": "stripe-cli-dryrun-live-rerun",
        "name": "Preview live mode without credentials",
        "method": "<evaluation>\\downloads\\cli\\stripe\\stripe.exe get /v1/customers --live --dry-run",
        "expected": "Observe what the live flag validates during dry-run.",
        "observed": "Exit 0. Dry-run JSON contained GET https://api.stripe.com/v1/customers with empty params and headers. It did not establish live-account authentication or mark an authorized live request.",
        "outcome": "pass"
      }
    ],
    "findings": [
      {
        "title": "A dry run is a request preview, not permission proof",
        "basis": "observed",
        "severity": "informational",
        "detail": "GET, POST and --live previews returned exit 0 with no credentials. They establish serialization only; neither account access nor live/test permission was validated.",
        "practicalAdvice": "Inspect the preview, then verify the selected account and mode separately in a dedicated Stripe sandbox before any real write."
      },
      {
        "title": "Test mode still changes account data when actually executed",
        "basis": "documented",
        "severity": "medium",
        "detail": "The official CLI can create test objects and trigger events. This pass never ran those account operations.",
        "practicalAdvice": "Use a dedicated sandbox and plan cleanup; reserve live mode for reviewed actions with narrowly scoped credentials."
      }
    ],
    "caveats": [
      "The tested previews do not demonstrate authentication, API validation, idempotency or webhook signatures.",
      "A successful --live dry-run is not evidence that a live operation is allowed."
    ],
    "notTested": [
      "Authenticated sandbox/live API requests, key scope enforcement and object lifecycle.",
      "Webhook forwarding/signature verification, event replay, payment execution and idempotency behavior."
    ],
    "sources": [
      {
        "label": "Official documentation",
        "url": "https://docs.stripe.com/stripe-cli"
      },
      {
        "label": "API keys and permissions",
        "url": "https://docs.stripe.com/cli/api_keys"
      }
    ],
    "reportUrl": "/interface-evaluations/stripe-cli.json"
  }
}