Loading javascript from another domain is deliberately not observable, so for it to have vulnerabilities stripe would have to be putting user data in javascript

Loading javascript from another domain is deliberately not observable, so for it to have vulnerabilities stripe would have to be putting user data in javascript responses, which seems unlikely. Given the article is deleted I don't know what points the author was making, but if you have found a way to convince stripe (or anyone else) to transmit user data in scripts you should probably report that. I don't know if they have a bug bounty program.