Rotate the exposed Stripe secret key

How to fix

1. 1 Roll the key in the Stripe dashboard (Developers > API keys). The old key stops working immediately, which is the only step that actually closes the exposure.
2. 2 Move the new key into a server-side environment variable or secret manager; never reference a secret key from client-side code.
3. 3 Purge the old key from git history (e.g. git filter-repo or BFG Repo-Cleaner). It stays recoverable from every prior commit otherwise.
4. 4 Redeploy and confirm, by inspecting the shipped bundle, that no Stripe secret key appears in it.

Common mistakes

• • Rotating the key in the Stripe dashboard but leaving the code path that reads it pointed at the client bundle, so the new key ships publicly too.
• • Removing the key from the current deploy without purging it from git history, leaving it retrievable from any prior commit.
• • Assuming a value loaded from a .env file is safe because the file itself is gitignored: if a bundler inlines environment variables at build time, the key ends up in the shipped JavaScript regardless of where it was stored.

How to verify

1. 1 Re-run the scan and confirm the Stripe secret key finding is gone.
2. 2 Grep the built/deployed JavaScript bundle for the sk_live_ prefix to confirm no secret key remains, not just the source files.
3. 3 Confirm the old key now returns an authentication error from Stripe rather than assuming the rotation took effect.

Related checks