Stripe secret key found in a React bundle — impact, rotation, prevention
Found sk_live_ in built React output? Rotate now, move checkout server-side. Scanner finds it in seconds — free.
This page assumes you may have already found one — in a report, in DevTools, in a security review. It moves in response order because order matters more than speed here.
Confirm, rotate in sequence, relocate the call, prove absence.
What actually happened
Either a scan flagged sk_live_ in served JS or someone spotted it manually. Both routes end at the same runbook; only the clock differs. The build reported success at every step, which is exactly why nobody stopped it.
- Confirm classification: literal starts sk_live_ (critical) vs rk_live_ (high) vs sk_test_ (medium). Sample-key shapes get excluded by serious scanners — verify yours is live-shaped before panicking.
- Create the replacement key first; do not revoke blind.
- Deploy every server consumer against the replacement.
- Revoke the exposed key; watch for breakage reports within minutes.
- Re-scan the deployment to confirm zero findings, then enable monitoring.
Every step above is individually reasonable and none of them prints a warning. The value crosses into the bundle during substitution, not execution, so nothing in your runtime ever sees the moment it happened.
What someone can do with it
Live money APIs under foreign control:
- Payment creation/refunds.
- Customer record reads.
- Dispute manipulation via evidence endpoints where scopes allow.
Rotate first
Do the rotation first. From the moment this value reached a public URL, treat it as public knowledge: browser caches, shared proxies and automated scrapers all hold copies you cannot recall. Sequence above keeps checkout alive while closing the hole — reversal of the naive order that outages stores. Code changes come after, because a clean repository with a compromised key is still compromised.
A rotated key left in old deploys is still discoverable in CDN caches and archived copies. Rotation plus redeploy closes both halves; either alone leaves the door ajar.
Move the call somewhere the browser cannot read
The structural fix is always the same shape: the call moves to a context that holds the key without serving it, and the browser asks your server instead.
// any client file:
const stripe = new Stripe("sk_live_FAKE000000000000000000000");// server route creates sessions; client holds pk_ only.
const session = await stripe.checkout.sessions.create(params);Check whether yours is exposed
You can check manually right now: open the site, view source or open DevTools, and search the built JavaScript for sk_live_. A hit means the string shipped; decode or prefix-check it before deciding how bad the news is.
The faster path is to let a machine do the fetching. KeyDrift downloads the same JavaScript a visitor gets — HTML, every referenced chunk including ones named only in the route manifest, and the server-streamed data frameworks inline into the document — and reports credentials with a masked prefix, a fingerprint, and the exact file they live in. Paste your deployed URL into the scanner; no account needed.
Keep it from coming back
It bears saying because it happens constantly: the fix holds until the next prompt that needs the query to return rows. Drift monitoring exists for precisely this — it diffs consecutive scans and pages you when a previously resolved finding reappears, naming the regression as a regression rather than repeating the first alert.
Restricted keys as blast-radius design
rk_live_ keys scope permissions deliberately. Issuing narrow server-side keys (charges-only, refunds-only) turns future incidents from account compromise into permission errors.
Why this failure class persists
It helps to name the economics honestly. Fixing this class of leak costs minutes when caught at deploy time and days when caught at invoice time, because by then the credential has been harvested, validated, resold or drained — often all four. Detection latency is the entire game, which is why the monitoring half of KeyDrift exists alongside the scanning half.
How KeyDrift reports this exact finding
When KeyDrift finds this on your deployment, the report shows a masked value (first 8 and last 4 characters only), a salted fingerprint for tracking, the exact chunk filename carrying it, and a severity with written rationale. Public-by-design neighbours — anon keys, publishable keys, Firebase web constants — appear as informational context rather than noise, because knowing what should be there is what makes the real findings credible.
Manual check, step by step
A five-minute version you can run anywhere: view-source on the landing page, copy every src= script URL, fetch each and search the results for sk_live_. It misses manifest-only chunks and streamed payloads — which is precisely the gap between "I checked" and "it is clean" — but it catches the loud majority and builds the pattern-recognition that makes scanner output legible.
Close the loop with monitoring
Monitoring closes the loop that one-time verification leaves open. A scheduled scan refetches everything, diffs against history, and fires only on transitions: created, regressed, resolved. Regression alerts matter most here — they fire when a previously fixed finding returns, which in agent-era codebases is less a possibility than a schedule.
Common questions
Already rotated — done?
Not until consumption moved server-side; otherwise the next deploy republishes. Monitoring catches that.
Notify customers?
Depends on data touched; the disclosure-considerations page frames questions for counsel without playing lawyer.
Run a free scan at keydrift.dev/scan — paste a URL or the bundle source itself, no account. Findings arrive masked, with the exact chunk they live in.