public credential
stripe-publishable-key· StripeStripe publishable key
Intended for the browser. It can only create payment tokens, not read or charge.
This is not a leak
KeyDrift matches this format on purpose, and then excludes it from the finding count. Recognising it is what makes the rest of the report trustworthy — a scanner that cannot tell this apart from a secret will either flag it and cry wolf, or stay quiet about the secret sitting next to it.
How it is detected
Matches `pk_live_` and `pk_test_`. Reported as a public credential: it is designed to be in the browser and can only tokenize payment details, never read or charge.
What to do
- 1Nothing to rotate. This credential is designed to be public.
Where it turns up
Most often in client bundles built by AI coding tools.