Stripe secret key shipped in the JavaScript
Publishable keys are designed to be public. Secret keys charge cards, issue refunds, and read customers. If the HTML or a same-origin script contains sk_live_, treat it as already copied.
Why this happens
- A .env value was prefixed with NEXT_PUBLIC_ or VITE_.
- Someone pasted the secret into a Lovable or Bolt chat and it landed in a client component.
- The Stripe dashboard's secret was copied next to the publishable key.
What ShipWatch looks for
- The free scan and the daily check both read the public HTML and same-origin scripts.
- sk_live_, service_role JWTs, and OpenAI keys are failures. The anon Supabase key is not, by itself.
Prompt to paste
A Stripe secret key is in the public page or JavaScript. Remove it from client code and roll the key in the Stripe dashboard. Only the publishable key belongs in the browser. Read the secret from a server environment variable.