Stripe restricted key

How it is detected

Matches the `rk_` prefix. What a restricted key can reach depends on the permissions granted when it was created, so the severity sits below a full secret key without being dismissed.

If you find one

1. 1Roll the key in the Stripe dashboard. Rolling issues a replacement and revokes the old key.
2. 2Review recent charges, refunds and payouts for anything you did not initiate.
3. 3Move the Stripe call into a server route. The browser only ever needs the publishable key.

Where it turns up

Most often in client bundles built by AI coding tools.