Stripe secret key exposed: what to do now

By Shinobi Tech, the team behind AppLeakWatch. Updated .

Roll the key in your Stripe dashboard straight away, then update your server with the new one. A live secret key starting with sk_live_ can act on your Stripe account, so it must never reach browser code or a public repository.

Why this happens

Keys starting with pk_ are publishable and fine in the browser. Keys starting with sk_ aren't. AI-generated code sometimes calls Stripe from the front end to make a feature work quickly.

How to check

  1. Search your built site for live secrets:
    grep -r "sk_live_" dist/ build/ .next/static/
  2. Search public repositories and old commits as well.
  3. Review recent payments, refunds, payouts and API activity in Stripe.

How to fix it

  1. Roll the key in the developer section of your Stripe dashboard.
  2. Add the new key as a server environment variable and redeploy.
  3. Move every Stripe call that uses it into server code.
  4. Use restricted keys so each key can do only what it needs.
  5. Contact Stripe support if you see activity you don't recognize.

Prompt for your AI tool

Find every use of a Stripe secret key in this project. Move those calls into server routes, read the key from a server environment variable, keep only the publishable key in the browser, and list every file you changed.

Review what your AI tool changes, and test the live site afterward.

Catch this before a stranger does

AppLeakWatch keeps checking your live app and emails you when something new appears.

Start your 7-day trial

Common questions

Is my publishable key a problem?

No. Keys starting with pk_ are made for the browser.

Is a test key dangerous?

It can't touch live money, but a test key on a live site is a sign your setup is wrong, so check that real payments work.

Related guides