Hardcoded service identifiers are scoped to config files

A Stripe price ID (price_1AbC...) hardcoded in an API route handler means the same literal string is duplicated across every checkout flow the AI generated. When the price changes — plan restructuring, annual pricing, regional variants — every scattered reference must be found and updated manually, with no guarantee they all match. CWE-798 applies because the same pattern that scatters price IDs also scatters webhook secrets (whsec_*), which must never appear as literals. OWASP A05 (Security Misconfiguration) covers the broader class: configuration that belongs in a single source of truth spread across the codebase is a maintenance and security misconfiguration by definition.

Centralize all Stripe identifiers in a single config file and import from there. Webhook secrets must always come from environment variables, never literals.

// lib/stripe.ts — single source of truth for all Stripe IDs
export const STRIPE_PRICE_IDS = {
  pro_monthly:  'price_1AbCdEfGhIjKlMnOp',
  pro_yearly:   'price_1XyZaBcDeFgHiJkLm',
} as const

export const STRIPE_PRODUCT_IDS = {
  pro: 'prod_AbCdEfGhIjKlMn',
} as const

// src/app/api/checkout/route.ts
import { STRIPE_PRICE_IDS } from '@/lib/stripe'

const session = await stripe.checkout.sessions.create({
  line_items: [{ price: STRIPE_PRICE_IDS.pro_monthly, quantity: 1 }],
})

For whsec_* values: remove the literal immediately and replace with process.env.STRIPE_WEBHOOK_SECRET. Webhook secrets in source code are a secret leak regardless of file location.