Checks

Stripe secret key in the browser

Strings matching sk_live_, sk_test_, rk_live_, or rk_test_. Publishable pk_ keys are not flagged.

In plain language

A Stripe secret key is in the client bundle. Secret keys can create charges and refunds. Publishable keys start with pk_.

Anyone who loads the page can copy a secret key. Roll it in the Stripe dashboard, and ship only the publishable key to the browser.

A generic fix prompt

Paste this into your coding agent, or apply it by hand:

A Stripe secret or restricted key is shipped to the browser. Remove sk_ and rk_ keys from client code and from public env vars. Rotate the key in the Stripe dashboard. The browser should only see a pk_ publishable key. Server routes keep the secret key.