Webhook signing secret

How it is detected

Matches the `whsec_` prefix. Often overlooked because it is not an API key — but it is the only thing standing between your endpoint and forged events.

If you find one

1. 1Roll the key in the Stripe dashboard. Rolling issues a replacement and revokes the old key.
2. 2Review recent charges, refunds and payouts for anything you did not initiate.
3. 3Move the Stripe call into a server route. The browser only ever needs the publishable key.

Where it turns up

Most often in client bundles built by AI coding tools.

Fix it in your stack

• Lovable
• Bolt.new
• Cursor
• Claude Code
• Replit
• Next.js