2026-11-12 · Daily security tips

Does your app use a full Stripe secret key it doesn't need?

Most AI-built apps paste the sk_live_ secret key into the server env and move on. That key can issue refunds, read customer details and change almost anything in your account. If it ever leaks, through a public repo, a log or a frontend bundle, all of that is open.

Check: look in your env vars and host settings for sk_live_. If your checkout route uses it, that route has full access.

Fix: in the Stripe Dashboard open Developers > API keys and create a restricted key (it starts with rk_live_). Give Read or Write only to what your code calls, like Checkout Sessions, and leave the rest at None. Try it in test mode first. A missing permission shows up as a clear error. Swap it in, redeploy, then roll the old secret key once nothing else uses it.