Description

Windows Security / Microsoft Defender appears to block or remove the Windows x86_64 Stripe CLI executable during installation.

I tried to install the Stripe CLI on Windows so I could run local webhook forwarding with:

stripe listen --forward-to http://localhost:3000/api/stripe/webhook

However, the Windows executable appears to be removed/quarantined after download or extraction. This prevents local webhook testing and prevents me from retrieving the local whsec_... signing secret.

Version / file

Affected file:

stripe_1.43.6_windows_x86_64.zip

If relevant, also affects:

stripe.exe

Please adjust if the exact affected version is:

stripe_1.43.5_windows_x86_64.zip

Environment

Operating system: Windows 11
Install methods tried:
- Direct Windows x86_64 ZIP download from GitHub releases
- Scoop install using the Stripe Scoop bucket

Stripe CLI version attempted:
1.43.6

What happened

When installing through Scoop, the install initially reported success:

Installing 'stripe' (1.43.6) [64bit] from 'stripe' bucket
Checking hash of stripe_1.43.6_windows_x86_64.zip ... ok.
Extracting stripe_1.43.6_windows_x86_64.zip ... done.
Creating shim for 'stripe'.
'stripe' (1.43.6) was installed successfully!

However, the expected executable was missing afterwards:

C:\Users\stein\scoop\apps\stripe\current\stripe.exe

The Scoop install folder contained only:

install.json
manifest.json

The shim pointed to:

C:\Users\stein\scoop\apps\stripe\current\stripe.exe

but that file did not exist.

Running stripe listen failed because the target executable could not be created/launched.

Expected behavior

The Windows x86_64 Stripe CLI executable should not be blocked or removed by Windows Security after installation.

I expected to be able to run:

stripe version
stripe login
stripe listen --forward-to http://localhost:3000/api/stripe/webhook

and receive a local webhook signing secret:

whsec_...

Actual behavior

The installation appears to complete, but stripe.exe is missing afterwards, likely because Windows Security / Microsoft Defender removed or quarantined it.

Why this matters

Without the Stripe CLI, local webhook testing is blocked for Windows users. In my case, this prevents testing a local Next.js subscription flow because the application cannot receive Stripe webhook events locally.

Request

Could the Stripe CLI team please investigate the Windows x86_64 release and, if this is a false positive, submit the binary to Microsoft for malware analysis / allowlisting so Windows Security no longer removes or quarantines it?

It would also help if the release notes or Windows installation docs included guidance for this specific Defender/Scoop failure mode.