Stripe API Keys Committed to Source Code

What Is This Vulnerability?

Stripe API keys (both publishable and secret keys) are embedded directly in application source code. When this code is pushed to a repository, anyone with access can extract the keys and make unauthorized charges, issue refunds, or access sensitive customer payment data through the Stripe API.

Why It Happens

Developers often hardcode Stripe keys during initial setup or prototyping and forget to move them to environment variables before committing. Copy-pasting from Stripe dashboard quickstart guides without adapting the code for production use is another common cause.

Example Code

const stripe = require("stripe")("sk_live_4eC39HqLyjWDarjtT1zdp7dc");

async function chargeCustomer(customerId: string, amount: number) {
  return stripe.charges.create({
    amount,
    currency: "usd",
    customer: customerId,
  });
}

const stripe = require("stripe")(process.env.STRIPE_SECRET_KEY);

async function chargeCustomer(customerId: string, amount: number) {
  if (!process.env.STRIPE_SECRET_KEY) {
    throw new Error("STRIPE_SECRET_KEY is not configured");
  }
  return stripe.charges.create({
    amount,
    currency: "usd",
    customer: customerId,
  });
}

How Hackers Exploit It

Attackers scan public repositories using automated tools that detect Stripe key patterns (sk_live_ and rk_live_ prefixes). Once found, they can process fraudulent charges, access customer data, modify account settings, and drain funds. Bots continuously scrape GitHub for newly committed secrets.

How to Fix It

Store Stripe keys in environment variables or a dedicated secrets manager such as AWS Secrets Manager or HashiCorp Vault. Add .env to your .gitignore file. Use Stripe restricted keys with only the permissions your application needs. Rotate any key that has ever been committed to version control.

Frequently Asked Questions