Leaked Stripe secret key (sk_live): what to do now
Your sk_live key ended up in a repo, bundle, or chat. The order of operations: roll it, check activity, fix the code.
A Stripe secret key can create charges and refunds, read customer data, and change your account settings through the API. Treat a leak as urgent.
Do this now, in order
- Roll the key in the Stripe Dashboard → Developers → API keys. Stripe lets you set the old key to expire immediately or after a short window so you can deploy the new one.
- Put the new key only on the server (env var on your host or edge function secrets), never in a
VITE_/NEXT_PUBLIC_variable. - Review activity: Dashboard → Developers → Logs for API requests you don't recognize, plus recent payments, refunds, payouts, and webhook endpoint changes.
- Check for other leaked secrets in the same place (webhook
whsec_, database URLs, model keys) and rotate them too. - If it was in Git, rotating is what matters. Rewriting history is optional cleanup; assume the old key was copied.
Reduce the blast radius next time
- Use restricted keys (
rk_…) with only the permissions each service needs. - Use Checkout or Payment Links so the browser only ever needs the publishable key.
- Enable secret scanning on your repo host.
Copy-paste into your AI builder
Find every place this project uses a Stripe secret or restricted key. Make sure it is read only from a server-side environment variable, never bundled to the browser, and replace any frontend usage with a server route. Tell me where to update the key after I roll it.
Related: Leaked OpenAI key · Verify Stripe webhooks
Scan your app free
Paste your URL. ShipLatch checks for leaked keys, exposed /.env and /.git, and flags Supabase/Firebase so you know what to lock down. The free scan finds the issues; the $29 Fix Pack gives you fix prompts written for your app and re-scans that prove each fix worked.
Want the whole pre-launch process in one place? Get App Security for Vibe Coders, our $9 PDF playbook.