docs: gate 0pt cutover on buyer-bound live payments

2026-09-15 18:53:35 +02:00
parent 7ce92827c0
commit c7f8b3f651
1 changed files with 9 additions and 0 deletions
@@ -36,6 +36,15 @@ Infra-provisionering + DNS + en skyddad-sökväg-PR (`cd.yml`). Rör aldrig
 - `COOLIFY_APP_ID` ifylld i `.gitea/workflows/cd.yml`? (skyddad sökväg → PR)
 - `COOLIFY_TOKEN`-secret satt? `cd.yml` är röd medvetet tills dess.
 - Secrets i Infisical-projektet 0pt (ej Vercel-env)?
+- Live payments: PR #66 reviewed/merged and issue #67 resolved with
+  verified buyer/tenant ownership, production Zitadel UI session, and
+  staging paid/unpaid/cancelled webhook E2E? If not, keep live Stripe
+  credentials absent and payment routes disabled. A green unit suite alone
+  does not authorize real customer charges.
+- Stripe live API key and endpoint-specific live webhook signing secret must
+  be acquired from the verified SIAX Technology AB account and injected only
+  into the intended server-side 0pt environment. Never reuse sandbox keys,
+  expose values in logs/PRs, or create empty vault placeholders.

 ## 2. Sekvens