Exposed key
Stripe key exposed: what to do
A live secret can create charges and export customers. A webhook secret can forge events your server trusts. The publishable key is not a reason to rotate the integration.
How to recognize it
A live secret looks like sk_live_ or rk_live_. A test secret is sk_test_ or rk_test_. A webhook secret starts with whsec_. Publishable keys, pk_live_ and pk_test_, are supposed to be in the browser.
What to do
Roll the secret or webhook key in the Stripe Dashboard. Remove it from client code and from public env prefixes. Verify webhook signatures on the server.
Paste the public URL of an app you own. The scan reads the page, up to 10 same-origin scripts, and /.env, /.env.local, and /.env.production. It does not search the whole internet, and it does not submit the key to Stripe to see if it still works.
What does an exposed Stripe key look like?
A live secret looks like sk_live_ or rk_live_. A test secret is sk_test_ or rk_test_. A webhook secret starts with whsec_. Publishable keys, pk_live_ and pk_test_, are supposed to be in the browser.
Do you store the key if the scan finds one?
No. The report stores a masked fragment and the kind of key. The full value is not written to the database, and the fix prompt does not repeat it.
What should I do with a leaked Stripe key?
Roll the secret or webhook key in the Stripe Dashboard. Remove it from client code and from public env prefixes. Verify webhook signatures on the server.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.