How to Find a Leaked Stripe Secret Key in Your Code

How to Find a Leaked Stripe Secret Key in Your Code

TL;DR: To find a leaked Stripe secret key, search your codebase for patterns like sk_live_ or sk_test_, scan git history for committed secrets, check client-side JavaScript, and monitor Stripe Dashboard for unusual activity. Use automated scanning tools to catch leaks early.

If you're building apps fast with AI coding tools, it's easy to accidentally commit a Stripe secret key. A leaked Stripe secret key gives attackers full access to your Stripe account — they can charge customers, refund orders, and steal sensitive data. Here's a practical guide to finding and removing leaked keys before they cause damage.

Why Leaked Stripe Secret Keys Are Dangerous

Stripe secret keys start with sk_live_ (for live mode) or sk_test_ (for test mode). If your live secret key is exposed, anyone with that key can:

The damage is immediate and often irreversible. Stripe's own documentation warns that secret keys should never be shared or exposed.

Step 1: Search Your Codebase for Patterns

The most obvious place to start is your source code. Use grep or your IDE's search to find any occurrence of sk_live_ or sk_test_. But attackers know these patterns too — they scrape GitHub and other public repositories for exactly these strings.

# Search for Stripe secret keys in your project
grep -r "sk_live_" .
grep -r "sk_test_" .

Also search for environment variable names like STRIPE_SECRET_KEY or STRIPE_API_KEY — the key might be hardcoded in a config file.

Step 2: Scan Git History

Keys often hide in commit history. Even if you removed the key from the latest commit, it's still accessible in older commits. Use git log -p to search through diffs:

git log -p --all -S "sk_live_"
git log -p --all -S "sk_test_"

This shows every commit that added or modified a line containing that pattern. If you find a leak, you'll need to rotate the key immediately.

Step 3: Check Client-Side Code

If you accidentally exposed your secret key in client-side JavaScript, it's visible to every visitor. Search your public JavaScript bundles for sk_live_ or STRIPE_SECRET. Tools like Secret Scanner can automate this across your entire site.

You can also manually check by viewing your site's source and searching for "sk_". But remember: Stripe publishable keys (starting with pk_) are meant to be public — only secret keys are dangerous.

Step 4: Monitor Stripe Dashboard

Stripe provides logs of API activity. Go to your Stripe Dashboard → Developers → Event Logs. Look for suspicious events like:

If you see anything unusual, rotate your key immediately.

Step 5: Use Automated Scanning

Manually searching is tedious and error-prone. Automated tools can scan your codebase, git history, and even deployed site for leaked secrets. OverMCP specializes in scanning vibe-coded apps for exactly these kinds of vulnerabilities — it checks for leaked API keys, including Stripe secret keys, across your entire stack.

How to Fix a Leaked Stripe Secret Key

If you find a leak, act fast:

Preventing Future Leaks

Real-World Example: A Close Call

A solo developer building a SaaS with Bolt.new accidentally committed a .env file containing a live Stripe secret key. Within hours, an automated bot scraped the repo and started making fraudulent charges. The developer only noticed after Stripe's fraud detection flagged unusual activity. By then, the attacker had charged over $5,000 in refunds to themselves.

This could have been avoided with a simple pre-commit hook or a scan before deployment. Don't let this happen to you.

Conclusion

A leaked Stripe secret key is a serious security risk, but it's preventable. Search your codebase, scan git history, check client-side code, and monitor your Stripe dashboard. Use automated tools to catch leaks early. If you find one, rotate the key immediately and clean your history.

For a comprehensive security scan of your vibe-coded app, including Stripe secret key detection, try OverMCP. It's built for makers who ship fast but don't want to skip security.

FAQ

How can I tell if my Stripe secret key has been leaked?

Check your Stripe Dashboard's event logs for suspicious API calls, charges from unknown IPs, or unauthorized refunds. You can also search public GitHub repos for your key using GitHub's search or tools like GitGuardian.

What should I do if I accidentally commit a Stripe secret key to a public repo?

Immediately rotate the key in your Stripe Dashboard. Then remove the key from your git history using git filter-branch or BFG Repo-Cleaner. Finally, force push the cleaned history and update your environment variables.

Can a leaked test key cause damage?

Test keys (sk_test_) only work in test mode and cannot access live data. However, leaking a test key still exposes your test environment, which may contain sensitive test data. It's best practice to treat test keys with the same caution as live keys.